CVE-2011-5025 Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) th...
MediumCVSS 4.3
EPSS 2.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) the index parameter to showOldPage.yaws, (3) the node parameter to allRefsToMe.yaws, or (4) the text parameter to editPage.yaws.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/yaws(Debian:12) | < 1.92-1 | 1.92-1 |
| debian/yaws(Debian:13) | < 1.92-1 | 1.92-1 |
| debian/yaws(Debian:14) | < 1.92-1 | 1.92-1 |
| yaws | = 1.88 | No fix listed |
References
- Debian Security Tracker CVE-2011-5025 vendor-advisory
- bugs.debian.org issue-tracking
- 51276 vdb-entry
- sitewat.ch url-repurposed