CVE-2006-0312

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2006-01/0322.html
http://evuln.com/vulns/37/summary.htmlExploit, Vendor Advisory
http://mikeheltonisawesome.com/viewcomments.php?idd=46URL Repurposed
http://secunia.com/advisories/16889Vendor Advisory
http://www.securityfocus.com/bid/16286Exploit
http://www.vupen.com/english/advisories/2006/0240
https://exchange.xforce.ibmcloud.com/vulnerabilities/24143
http://archives.neohapsis.com/archives/bugtraq/2006-01/0322.html
http://evuln.com/vulns/37/summary.htmlExploit, Vendor Advisory
http://mikeheltonisawesome.com/viewcomments.php?idd=46URL Repurposed
http://secunia.com/advisories/16889Vendor Advisory
http://www.securityfocus.com/bid/16286Exploit
http://www.vupen.com/english/advisories/2006/0240
https://exchange.xforce.ibmcloud.com/vulnerabilities/24143

Timeline

Published: Jan 19, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-03137.5Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unsp CVE-2006-03147.5PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct que CVE-2006-03155.8index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allo CVE-2006-031610.0Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and CVE-2006-03174.3Cross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary CVE-2006-03187.5SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL CVE-2006-03195.0Directory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary fil CVE-2006-03207.5SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypas CVE-2006-03215.0fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages tha CVE-2006-03225.0Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers CVE-2006-03239.3Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, Rhapsody 3, and H CVE-2006-03247.5SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via t