CVE-2014-9004 Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a member_profile action to index.php.
MediumCVSS 4.3
EPSS 1.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a member_profile action to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vld interactive vldpersonals | <= 2.7 | No fix listed |
References
- 35193 exploit
- vldpersonals-index-xss(98742) vdb-entry