Multiple cross-site scripting (XSS) vulnerabilities in Pre News Manager 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) index.php, and the (2) nid parameter to (b) news_detail.php, © email_story.php, (d) thankyou.php, (e) printable_view.php, (f) tella_friend.php, and (g) send_comments.php.
secunia.com/advisories/20284
securityreason.com/securityalert/996
www.osvdb.org/26066
www.osvdb.org/26067
www.osvdb.org/26068
www.osvdb.org/26069
www.osvdb.org/26070
www.osvdb.org/26071
www.osvdb.org/26072
www.securityfocus.com/archive/1/435020/100/0/threaded
www.securityfocus.com/bid/18333
www.vupen.com/english/advisories/2006/1990
exchange.xforce.ibmcloud.com/vulnerabilities/26692