CVE-2010-5064 Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challen...
MediumCVSS 4.3
EPSS 0.98%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challenge.php, the (2) Additional Information or (3) Contact information field to joinus.php, (4) the War Report field to admin/admin.php in a finishwar action, or (5) the Nick field to profile.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | = 1.6.1-r2 | No fix listed |
References
- dmcdonald.net exploit
- 20100822 VWar 1.6.1 R2 Multiple Remote Vulnerabilities exploit mailing-list