Description

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.

Remediation

References

CVE-2004-2040

Related Vulnerabilities

XOOPS Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-0613)

WordPress Plugin Mailtree Log Mail Cross-Site Scripting (1.0.0)

MySQL CVE-2018-2573 Vulnerability (CVE-2018-2573)

MySQL CVE-2015-0441 Vulnerability (CVE-2015-0441)

MySQL CVE-2016-3588 Vulnerability (CVE-2016-3588)

Severity

Medium

Classification

CVE-2004-2040

Tags

Missing Update Known Vulnerabilities