Vulners
Lucene search
Pmwiki Cross Site Scripting
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2010-1481 | 11 May 201023:00 | – | cve |
 | CVE-2010-1481 | 11 May 201023:00 | – | cvelist |
 | EUVD-2010-1508 | 7 Oct 202500:30 | – | euvd |
 | CVE-2010-1481 | 12 May 201011:46 | – | nvd |
 | PmWiki < 2.2.16 XSS Vulnerability | 25 May 201000:00 | – | openvas |
| PmWiki Table Feature 'width' Parameter Cross-site scripting vulnerability | 25 May 201000:00 | – | openvas |
 | Cross site scripting | 12 May 201011:46 | – | prion |
 | pmwiki: persistent cross site scripting (XSS), CVE-2010-1481 | 11 May 201000:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 13 May 201000:00 | – | securityvulns |
 | PmWiki 2.2.15 width参数跨站脚本漏洞 | 12 May 201000:00 | – | seebug |
10
`pmwiki: persistent cross site scripting (XSS), CVE-2010-1481
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1481
http://int21.de/cve/CVE-2010-1481-pmwiki-xss.html
Description
The table feature of pmwiki is vulnerable to persistent cross site scripting
(XSS). The value of the width-parameter is not proberly escaped on output, so
one can put quotes in it. This makes it possible to use a JavaScript event
handler inside the first table field to inject code.
Example:
||width="
|| " onMouseOver=alert(1) " ||test||
The vendor has been contacted, but has not replied to my report.
Disclosure Timeline
2010-04-19: Vendor contacted
2010-05-07: Published advisory
Credits
This vulnerability was discovered by Hanno Boeck, http://www.hboeck.de, of
schokokeks.org webhosting.
--
Hanno Böck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: [email protected]
http://schokokeks.org - professional webhosting
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 May 2010 00:00Current
6.6Medium risk
Vulners AI Score6.6
EPSS0.00201