Description

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.

Remediation

References

CVE-2004-2040

Related Vulnerabilities

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5276)

Jenkins Incorrect Authorization Vulnerability (CVE-2020-2104)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Remote Code Execution (2.05.01)

Spring Cloud Gateway Improper Certificate Validation Vulnerability (CVE-2022-22946)

WordPress Plugin WooCommerce Conversion Tracking Cross-Site Request Forgery (2.0.4)

Severity

Medium

Classification

CVE-2004-2040

Tags

Missing Update Known Vulnerabilities