CVE-2007-6374 Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) users/register.php or (2) sear...
MediumCVSS 4.3
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) users/register.php or (2) search/index.php, or an editcomments action in (3) wiki/index.php or (4) forums/index.php. NOTE: the error parameter to users/login.php is covered by CVE-2006-3103.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bitweaver | <= 2.0.0 | No fix listed |
References
- 39129 vdb-entry
- 39130 vdb-entry
- 28024 third-party-advisory
- 3428 third-party-advisory
- www.hackerscenter.com exploit
- 20071209 Bitweaver XSS & SQL Injection Vulnerability mailing-list
- 26801 vdb-entry
- ADV-2007-4168 vdb-entry
- bitweaver-register-index-login-xss(38942) vdb-entry