Cross site scripting

2009-02-0917:30:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to index.php/Special/Main/keywordSearch, (2) revNum parameter to index.php/Edit/Main/Home, (3) to parameter to index.php/Special/Main/WhatLinksHere, (4) user parameter to index.php/Special/Main/UserEdits, and (5) the PATH_INFO to index.php.

CPENameOperatorVersion
wikyblogeq1.6.1.4
wikyblogle1.7
wikyblogeq1.7.1 rc1
wikyblogeq1.3.2
wikyblogeq1.4.8
wikyblogeq1.5.1
wikyblogeq1.6.1
wikyblogeq1.7.1.1
wikyblogeq1.7.1-b2
wikyblogeq1.4.15

Name	Operator	Version
wikyblog	eq	1.6.1.4
wikyblog	le	1.7
wikyblog	eq	1.7.1 rc1
wikyblog	eq	1.3.2
wikyblog	eq	1.4.8
wikyblog	eq	1.5.1
wikyblog	eq	1.6.1
wikyblog	eq	1.7.1.1
wikyblog	eq	1.7.1-b2
wikyblog	eq	1.4.15

Rows per page:

1-10 of 581

References

osvdb.org/48790

secunia.com/advisories/32087

sourceforge.net/project/shownotes.php?group_id=148518&release_id=647444

www.digitrustgroup.com/advisories/web-application-security-wikyblog.html

www.securityfocus.com/bid/31525

exchange.xforce.ibmcloud.com/vulnerabilities/45603