CVE-2012-6671 Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers...
MediumCVSS 6.1
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the (1) monster[title] or (2) monster[description] parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dragonbyte-tech forumon rpg module | < 1.0.8 | 1.0.8 |
References
- 48490 permissions-required third-party-advisory
- 48514 permissions-required third-party-advisory
- www.dragonbyte-tech.com patch vendor-advisory
- 52707 third-party-advisory vdb-entry