# CVEs published 2006-12-28 33 CVEs were published on December 28, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-6799](https://cve.now/CVE-2006-6799.md): SQL injection vulnerability in Cacti 0.8.6i and earlier, when register\_argc\_argv is enabled, allows remote attackers to execute arbitrary SQ (no CVSS) - [CVE-2006-6800](https://cve.now/CVE-2006-6800.md): PHP remote file inclusion in eventcal/mod\_eventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PH (no CVSS) - [CVE-2006-6801](https://cve.now/CVE-2006-6801.md): PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register\_globals is enabled, allows remote attackers to execute ar (no CVSS) - [CVE-2006-6802](https://cve.now/CVE-2006-6802.md): SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL commands via the Biz\_ID (no CVSS) - [CVE-2006-6803](https://cve.now/CVE-2006-6803.md): SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL commands via the Type\_id (no CVSS) - [CVE-2006-6804](https://cve.now/CVE-2006-6804.md): SQL injection vulnerability in bus\_details.asp in Dragon Business Directory - Pro (aka Dragon Internet Business Search Directory - Pro) 3.01 (no CVSS) - [CVE-2006-6805](https://cve.now/CVE-2006-6805.md): SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL commands via the ID para (no CVSS) - [CVE-2006-6806](https://cve.now/CVE-2006-6806.md): SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID (no CVSS) - [CVE-2006-6807](https://cve.now/CVE-2006-6807.md): SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attackers (no CVSS) - [CVE-2006-6808](https://cve.now/CVE-2006-6808.md): Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2006-6318](https://cve.now/CVE-2006-6318.md): The show\_elog\_list function in elogd.c in elog 2.6.2 and earlier allows remote authenticated users to cause a denial of service (daemon cras (no CVSS) - [CVE-2006-6797](https://cve.now/CVE-2006-6797.md): The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary (no CVSS) - [CVE-2006-6776](https://cve.now/CVE-2006-6776.md): Multiple SQL injection vulnerabilities in Future Internet allow remote attackers to execute arbitrary SQL commands via the (1) newsId or (2) (no CVSS) - [CVE-2006-6777](https://cve.now/CVE-2006-6777.md): Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2006-6778](https://cve.now/CVE-2006-6778.md): Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2006-6779](https://cve.now/CVE-2006-6779.md): Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file (no CVSS) - [CVE-2006-6780](https://cve.now/CVE-2006-6780.md): SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2006-6781](https://cve.now/CVE-2006-6781.md): HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and p (no CVSS) - [CVE-2006-6782](https://cve.now/CVE-2006-6782.md): Cross-site scripting (XSS) vulnerability in pnamazu 2006.02.28 and earlier allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2006-6783](https://cve.now/CVE-2006-6783.md): logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/\_widged (no CVSS) - [CVE-2006-6784](https://cve.now/CVE-2006-6784.md): SQL injection vulnerability in Netbula Anyboard allows remote attackers to execute arbitrary SQL commands via the user name in the login for (no CVSS) - [CVE-2006-6785](https://cve.now/CVE-2006-6785.md): The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows (no CVSS) - [CVE-2006-6786](https://cve.now/CVE-2006-6786.md): Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the emai (no CVSS) - [CVE-2006-6787](https://cve.now/CVE-2006-6787.md): SQL injection vulnerability in admin/admin\_mail\_adressee.asp in Newsletter MX 1.0.2 and earlier allows remote attackers to execute arbitrary (no CVSS) - [CVE-2006-6788](https://cve.now/CVE-2006-6788.md): Multiple PHP remote file inclusion vulnerabilities in LuckyBot 3 allow remote attackers to execute arbitrary PHP code via a URL in the dir p (no CVSS) - [CVE-2006-6789](https://cve.now/CVE-2006-6789.md): PHP remote file inclusion vulnerability in includes/archive/archive\_topic.php in Phpbbxtra 2.0 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2006-6790](https://cve.now/CVE-2006-6790.md): Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject (no CVSS) - [CVE-2006-6791](https://cve.now/CVE-2006-6791.md): SQL injection vulnerability in SelGruFra.asp in chatwm 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) txtUse and (no CVSS) - [CVE-2006-6792](https://cve.now/CVE-2006-6792.md): SQL injection vulnerability in calendar\_detail.asp in Calendar MX BASIC 1.0.2 and earlier allows remote attackers to execute arbitrary SQL c (no CVSS) - [CVE-2006-6793](https://cve.now/CVE-2006-6793.md): PHP remote file inclusion vulnerability in ataturk.php in Okul Merkezi Portal 1.0 allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2006-6794](https://cve.now/CVE-2006-6794.md): SQL injection vulnerability in default.asp in Efkan Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the grup paramet (no CVSS) - [CVE-2006-6795](https://cve.now/CVE-2006-6795.md): PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My\_eGallery 2.5.6 module in myPHPNuke (MPN) allows remote atta (no CVSS) - [CVE-2006-6796](https://cve.now/CVE-2006-6796.md): PHP remote file inclusion vulnerability in admin/admin\_settings.php in MTCMS 2.0 and earlier allows remote attackers to execute arbitrary PH (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-12-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.