Cross site scripting

Cross-site scripting XSS vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly...

CVE-2007-0768

Multiple cross-site scripting XSS vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the 1 First Name, 2 Last Nam...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Free LAN Intra|ternet Portal FLIP before 1.0-RC2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 inc.page.php and 2 inc.text.php...

CVE-2007-0590

Cross-site scripting XSS vulnerability in busca2.asp in Forum Livre 1.0 remote attackers to inject arbitrary web script or HTML via the palavra parameter...

CVE-2007-0553

Multiple cross-site scripting XSS vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the 1 datarealm and 2 url parameters, different vectors than CVE-2004-2604. NOTE: some of these details are obtained from third party...

CVE-2007-0547

Cross-site scripting XSS vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-0519

Cross-site scripting XSS vulnerability in memcp.php in XMB U2U Instant Messenger allows remote authenticated users to inject arbitrary web script or HTML via the recipient field...

CVE-2007-0526

CVE-2007-0526 describes multiple XSS vulnerabilities in Bitweaver 1.3.1. The attack vectors exploit the PATH_INFO portion of the URL to inject arbitrary script/HTML via the following pages: articles/edit.php, articles/list.php, blogs/list_blogs.php, and blogs/rankings.php. Root cause is cross-sit...

Cross site scripting

Cross-site scripting XSS vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 beta allows remote attackers to inject arbitrary web script or HTML via the username parameter during anonymous registration, a different vector than CVE-2007-0308. NOTE: it is possible that a separate...

CVE-2007-0399

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

CVE-2007-0390

Cross-site scripting XSS vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via the tag parameter...

CVE-2007-0364

Multiple cross-site scripting XSS vulnerabilities in nicecoder.com INDEXU 5.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 errormsg parameter to a suggestcategory.php; the 2 u parameter to b userdetail.php; the 3 friendname, 4 friendemail, 5 errormsg, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

CVE-2007-0302

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

CVE-2006-6936

The CVE-2006-6936 entry describes a cross-site scripting (XSS) vulnerability in Xtreme ASP Photo Gallery. The vulnerability is triggered by user-supplied input in two vectors: (1) the catname parameter to displaypic.asp and (2) the search field, enabling remote attackers to inject arbitrary HTML/...

CVE-2007-0266

SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter...

CVE-2007-0249

Cross-site scripting XSS vulnerability in index.php in Nwom topsites 3.0 allows remote attackers to inject arbitrary web script or HTML via the o parameter...

CVE-2007-0258

Cross-site scripting XSS vulnerability in index.php in 1 Fastilo 2.0 and 2 Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6487

CVE-2006-6487: XSS in dt_guestbook 1.0f (index.php) when PHP register_globals is On. The vulnerability allows remote attackers to inject arbitrary script via the error[] parameter, enabling a reflected XSS in the victim’s browser. Affected product: dt_guestbook 1.0f; attack requires On register_g...

CVE-2007-0231

CVE-2007-0231 describes a cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33 where, if nofollow is disabled and unmoderated comments are enabled, a remote attacker can inject arbitrary web script or HTML via the Comments field. The vulnerability concerns Movable Type 3.33 and is t...