CVE-2006-4794

EPSS 4.6%

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6) search.php, (7) signup.php, (8) submitnews.php, and (9) user.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

Affected products

n/a · n/a

public PoCs found — 9

exploitdbwww.exploit-db.com/exploits/28547unverified exploitdbwww.exploit-db.com/exploits/28545unverified exploitdbwww.exploit-db.com/exploits/28546unverified exploitdbwww.exploit-db.com/exploits/28548unverified exploitdbwww.exploit-db.com/exploits/28549unverified exploitdbwww.exploit-db.com/exploits/28551unverified exploitdbwww.exploit-db.com/exploits/28552unverified exploitdbwww.exploit-db.com/exploits/28554unverified exploitdbwww.exploit-db.com/exploits/28556unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://www.osvdb.org/30979 http://www.osvdb.org/30980 http://www.osvdb.org/30981 http://www.osvdb.org/30982 http://www.osvdb.org/30983 http://www.osvdb.org/30984 http://www.osvdb.org/30985 http://www.osvdb.org/30986 http://www.osvdb.org/30987 http://www.securityfocus.com/bid/19997 http://www.securityfocus.com/data/vulnerabilities/exploits/19997.html