CVE-2014-10035 Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to commen...
MediumCVSS 4.3
EPSS 3.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the (1) sEcho parameter to comments_paginate.php or (2) stores_paginate.php or the (3) affiliate_url, (4) description, (5) domain, (6) seo[description], (7) seo[heading], (8) seo[title], (9) seo[keywords], (10) setting[logo], (11) setting[perpage], or (12) setting[sitename] to admin/index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| couponphp | <= 1.1.0 | No fix listed |
References
- couponphp.com
- 103886 vdb-entry
- 103887 vdb-entry
- 103897 vdb-entry
- packetstormsecurity.com exploit
- 57177 third-party-advisory
- 32037 exploit
- www.zeroscience.mk exploit