Lucene search

MitreCVELIST:CVE-2010-2854

HistoryJul 23, 2010 - 8:00 p.m.

CVE-2010-2854

2010-07-2320:00:00

mitre

www.cve.org

cve-2010-2854

cross-site scripting

modfile.php

event horizon

remote attackers

arbitrary web script

html

magic_quotes_gpc

sql error message

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

49.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in modfile.php in Event Horizon (EVH) 1.1.10, when magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) YourEmail and (2) VerificationNumber parameters, which are not properly handled in a forced SQL error message. NOTE: some of these details are obtained from third party information.

References

freshmeat.net/projects/eventh/

secunia.com/advisories/40517