CVE-2004-0271

EPSS 2.1%

Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/23676unverified exploitdbwww.exploit-db.com/exploits/23677unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://marc.info/?l=bugtraq&m=107643014606515&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/15120 https://exchange.xforce.ibmcloud.com/vulnerabilities/15122 http://www.securityfocus.com/bid/9625