CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4784
https://notcve.org/view.php?id=CVE-2006-4784
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Moodle 1.6.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante parámetros no especificados para (1) dos/index.php o (2) files/index.php. • http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2 http://secunia.com/advisories/21899 http://www.securityfocus.com/bid/19995 http://www.vupen.com/english/advisories/2006/3591 https://exchange.xforce.ibmcloud.com/vulnerabilities/28905 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4785
https://notcve.org/view.php?id=CVE-2006-4785
SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int. Vulnerabilidad de inyección SQL en el blog/edit.php del Moodle 1.6.1 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro format como el almacenado en la variable $blogEntry, lo que no es correctamente manejado por la función insert_record, lo que llama al _adodb_column_sql en la capa adodb (lib/adodb/adodb-lib.inc.php), y no convierte este tipo de datos a un entero (int). • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 http://secunia.com/advisories/21899 http://securitytracker.com/id?1016877 http://www.attrition.org/pipermail/vim/2006-September/001038.html http://www.attrition.org/pipermail/vim/2006-September/001040.html http://www.securityfocus.com/archive/1/446227/100/0/threaded http://www.securityfocus.com/bid/19995 http://www.securityfocus.com/bid/20085 http://www.vupen.com/english/advisories/2006/3591 https://exchange.xforce.ibmcl • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •