CVE-2007-6367 Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (user) or (2) comme...
MediumCVSS 4.3
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (user) or (2) comment (commento) field, different vectors than CVE-2007-2357.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sinecms | <= 2.3.4 | No fix listed |
References
- 27949 third-party-advisory vendor-advisory
- 3444 third-party-advisory
- 20071205 SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. mailing-list
- 20071218 Re: SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. mailing-list
- sinecms-mods-xss(38893) vdb-entry
- 4693 exploit