Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote malicious users to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
nuked-klan nuked-klan 1.7_sp4.3 |
Vulmon