CVE-2012-0984 Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the....
MediumCVSS 4.3
EPSS 4.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xoops | <= 2.5.4 | No fix listed |
| xoops | = 2.5.0 | No fix listed |
| xoops | = 2.5.1 | No fix listed |
| xoops | = 2.5.2 | No fix listed |
| xoops | = 2.5.2-rc | No fix listed |
| xoops | = 2.5.3 | No fix listed |
References
- 20120418 Multiple XSS vulnerabilities in XOOPS exploit mailing-list
- 81212 vdb-entry
- 81213 vdb-entry
- packetstormsecurity.org exploit
- 48887 third-party-advisory
- 18753 exploit
- 53143 vdb-entry
- xoops.org patch vendor-advisory
- xoops-pmlite-xoopsimagebrowser-xss(75024) vdb-entry
- www.htbridge.com exploit