The remote web server contains a PHP application that is affected by several cross-site scripting vulnerabilities. Description : The remote version of PunBB is vulnerable to cross-site scripting flaws through 'install.php' script. With a specially-crafted URL, an attacker can inject arbitrary HTML and script code into a user's browser resulting in the possible theft of authentication cookies, mis-representation of site contents, and the like.

Update to PunBB version 1.1.2 or later.

• http://www.punbb.org/changelogs/1.1.1_to_1.1.2.txt

---

Updated on 2015-03-25