CVE-2008-2563: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 dspmain.php and 2 dsptaskeditor.php in SamTodo 1.1 allow remote attackers to inject arbitrary web script or HTML via the a tid parameter in a main.taskeditor edit action, and the b completed parameter in a main.default action, to index.php...

samtodo-xss.txt

Original advisory: http://www.davidsopas.com/soapbox/samtodo.txt XSS in SamTodo v1.1 http://samjlevy.com/samtodo by David Sopas Ferreira Found and reported at : 22-05-2008PT Full disclosure at : 05-06-2008PT ?!--------------------------------------------------------- Flaws -----!? XSS attacks on...