CVE-2007-0399 Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or...
MediumCVSS 6.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) recipient or (2) BCC field when selecting send in a pm action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simple machines forum | = 1.1_rc3 | No fix listed |
References
- aria-security.com
- 32606 vdb-entry
- 2169 third-party-advisory
- 20070120 SMF "index.php?action=pm" Cross Site-Scripting mailing-list
- 20070121 Re: SMF "index.php?action=pm" Cross Site-Scripting mailing-list
- 20070122 Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting mailing-list
- 20070126 Re: Re: Re: Re: SMF "index.php?action=pm" Cross Site-Scripting mailing-list
- 20070202 Re: SMF "index.php?action=pm" Cross Site-Scripting mailing-list
- 22143 vdb-entry
- smf-pm-xss(31612) vdb-entry