SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.
CPE | Name | Operator | Version |
---|---|---|---|
syguestbook_a5 | eq | 1.2 |