CVE-2009-4385

CVE-2009-4385 describes multiple CSRF vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH). Attackers can hijack user authentication to perform delete_poll (index.php) and administrator authentication to delete users (admin.php) or send arbitrary email (admin.php). The affected components are th...

CVE-2009-4384

CVE-2009-4384 affects Scriptsez.net Ez Poll Hoster (EPH). The vulnerabilities are cross-site scripting (XSS) via two parameters: the pid parameter in a code action to index.php and the uid parameter in a view action to profile.php. Root cause: insufficient input validation allowing injection of a...