Description

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.

Remediation

References

CVE-2012-4247

Related Vulnerabilities

MediaWiki Improper Input Validation Vulnerability (CVE-2017-0370)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43717)

b2evolution Other Vulnerability (CVE-2007-2681)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2018-1302)

Drupal Improper Authentication Vulnerability (CVE-2006-1228)

Severity

Medium

Classification

CVE-2012-4247 CWE-707

Tags

Missing Update Known Vulnerabilities