Description

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.

Remediation

References

CVE-2004-2040

Related Vulnerabilities

Magento Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2015-1399)

WordPress Plugin Countdown and CountUp, WooCommerce Sales Timer Cross-Site Request Forgery (1.5.7)

SharePoint CVE-2021-26420 Vulnerability (CVE-2021-26420)

OpenSSL Resource Management Errors Vulnerability (CVE-2014-3506)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2360)

Severity

Medium

Classification

CVE-2004-2040

Tags

Missing Update Known Vulnerabilities