First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2006-6972

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameters. NOTE: it is not clear whether this issue is exploitable.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Feb 7, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-69737.5Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, whi CVE-2006-69747.5Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers CVE-2006-69759.8PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a UR CVE-2006-69767.5PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to execute arbitrary c CVE-2006-69774.3Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FreeTextBox allows remote attackers to execute arbitrary JavaSc CVE-2006-69784.3Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attackers to execute arbitrary JavaScri CVE-2006-69797.5The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an CVE-2006-69802.6The magnatune.com album browser in Amarok allows attackers to cause a denial of service (application crash) via unspecified vectors.CVE-2006-69815.03proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service (blocked account) via un CVE-2006-69825.03proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC26 CVE-2006-69835.0Cross-domain vulnerability in MYweb4net Browser 3.8.8.0 allows remote attackers to access restricted information from other domains via an o CVE-2006-69845.0Cross-domain vulnerability in GreenBrowser 3.4.0622 allows remote attackers to access restricted information from other domains via an objec

CVE-2006-6972: High severity, CVSS 7.5 | Vulnix