Artefact St. CMS Cross Site Scripting / Path Disclosure

`I want to warn you about Cross-Site Scripting, Brute Force and Full path  
disclosure vulnerabilities in Artefact St. CMS. It's Ukrainian commercial  
CMS.  
  
SecurityVulns ID: 11531.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are all versions of Artefact St. CMS and Artefact St. CMS light   
version.  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
http://site/search/?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Brute Force (WASC-11):  
  
http://site/admin/  
  
Full path disclosure (WASC-13):  
  
http://site/view.php?id=  
  
------------  
Timeline:  
------------  
  
2011.01.26 - announced at my site.  
2011.01.27 - informed developers.  
2011.01.28 - received response from developers.  
2011.01.31 - gave additional recommendations for developers.  
2011.03.24 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4876/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`