CVE-2005-3902 Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attackers to inject arbitrary web script or HTML via qu...
MediumCVSS 4.3
EPSS 2.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attackers to inject arbitrary web script or HTML via query strings that are included in an error message, as demonstrated using a parameter containing script.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| virtual hosting control system | = 2.2 | No fix listed |
| virtual hosting control system | = 2.4 | No fix listed |
| virtual hosting control system | = 2.4.6 | No fix listed |
| virtual hosting control system | = 2.4.6.2 | No fix listed |
References
- 20051122 VHCS 2.x HTTP Error Cross Site Scripting mailing-list patch vendor-advisory
- 20051122 VHCS 2.x HTTP Error Cross Site Scripting mailing-list
- moritz-naumann.com patch vendor-advisory
- 17704 patch third-party-advisory vendor-advisory
- 202 third-party-advisory
- 21060 exploit vdb-entry
- 15538 exploit vdb-entry
- vhcs-http-error-xss(23209) vdb-entry