CVE-2006-6994

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execute arbitrary ASP files by removing the client-side security checks.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 12, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2006

CVE-2006-69956.0mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter.CVE-2006-69964.3Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via CVE-2006-699710.0Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and EnterCVE-2006-69985.0install/loader_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY_STRCVE-2006-69994.3attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified CVE-2006-70005.0Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to (1) email/mail.php, (2) includes/init.phpCVE-2006-70017.1Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. (CVE-2006-70024.3Cross-site scripting (XSS) vulnerability in add_comment.php in Wheatblog (wB) 1.1 allows remote attackers to inject arbitrary web script or CVE-2006-70037.5PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL iCVE-2006-70046.8Cross-site scripting (XSS) vulnerability in email_request.php in PSY Auction allows remote attackers to inject arbitrary web script or HTML CVE-2006-70057.5SQL injection vulnerability in item.php in PSY Auction allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE:CVE-2006-70067.5PHP remote file inclusion vulnerability in upload/admin/team.php in Robin de Graff Somery 0.4.4 allows remote attackers to execute arbitrary
CVE-2006-6994: Medium severity, CVSS 6.4 | Vulnix