CVE-2009-4649

2010-02-2220:00:00

mitre

www.cve.org

5.8 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in geccBBlite 0.1 allow remote attackers to inject arbitrary web script or HTML via the postatoda parameter to (1) rispondi.php and (2) scrivi.php, which is not properly handled in forum.php.

References

groups.csail.mit.edu/pag/ardilla/

groups.csail.mit.edu/pag/ardilla/geccbblite-XSS2-lenient-T.txt

groups.csail.mit.edu/pag/ardilla/geccbblite-XSS2-strict-T.txt

www.securityfocus.com/bid/35449

exchange.xforce.ibmcloud.com/vulnerabilities/56278