CVE-2006-5239 Multiple cross-site scripting (XSS) vulnerabilities in eXpBlog 0.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the query string (PHP_SELF) in kalender.php or (2...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in eXpBlog 0.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the query string (PHP_SELF) in kalender.php or (2) the captcha_session_code parameter in pre_details.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| expblog | <= 0.3.5 | No fix listed |
References
- 20061009 eXpBlog <= 0.3.5 Cross Site Scripting mailing-list
- 22328 third-party-advisory vendor-advisory
- 1017028 vdb-entry
- www.expblog.de patch
- 20061009 eXpBlog <= 0.3.5 Cross Site Scripting Vulnerabilities mailing-list
- 20420 exploit vdb-entry
- ADV-2006-3973 vdb-entry vendor-advisory
- expblog-multiple-xss(29409) vdb-entry