CVE-2007-5692 Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to integrator.php; (2) the token parameter...
MediumCVSS 4.3
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to integrator.php; (2) the token parameter in a New Password action, (3) the nid_acl parameter in a Folder Properties action, or (4) the uid parameter in a Modify User action to command.php; or (5) the target parameter to index.php, different vectors than CVE-2006-3320.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sitebar | = 3.3.8 | No fix listed |
References
- 41355 vdb-entry
- 41356 vdb-entry
- 41357 vdb-entry
- 41358 vdb-entry
- 41359 vdb-entry
- 27503 third-party-advisory
- 28008 third-party-advisory
- 3318 third-party-advisory
- teamforge.net patch
- DSA-1423 vendor-advisory
- GLSA-200711-05 vendor-advisory
- 20071018 Serious holes affecting SiteBar 3.3.8 mailing-list
- 26126 exploit patch vdb-entry
- ADV-2007-3768 vdb-entry