CVE-2011-3978 Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentm...
LowCVSS 3.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentmessage, or (3) commentname parameter in a sendcomment action for the news page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lightneasy | = 3.2.4 | No fix listed |
References
- 75262 vdb-entry
- 45955 third-party-advisory vendor-advisory
- 8407 third-party-advisory
- www.lightneasy.org exploit
- www.rul3z.de exploit
- 20110908 Multiple XSS vulnerabilities in LightNEasy 3.2.4 mailing-list
- lightneasy-lightneasy-multiple-xss(69737) vdb-entry