Published: 28/12/2007 Updated: 15/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 445

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and previous versions allow remote malicious users to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dokeos open source learning and knowledge management tool 1.5.4
dokeos open source learning and knowledge management tool 1.5.5
dokeos open source learning and knowledge management tool 1.6.4
dokeos open source learning and knowledge management tool 1.6.5
dokeos open source learning and knowledge management tool 1.4
dokeos open source learning and knowledge management tool 1.5
dokeos open source learning and knowledge management tool 1.5.3
dokeos open source learning and knowledge management 1.8
dokeos open source learning and knowledge management 1.8.4
dokeos open source learning and knowledge management tool 1.8
dokeos open source learning and knowledge management tool 1.8.4

source: wwwsecurityfocuscom/bid/26992/info Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the attack ...

source: wwwsecurityfocuscom/bid/26992/info Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the at ...

source: wwwsecurityfocuscom/bid/26992/info Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the atta ...

CWE-79 http://www.securityfocus.com/bid/26992 http://securityreason.com/securityalert/3481 http://osvdb.org/39773 http://osvdb.org/39771 http://osvdb.org/39772 http://www.securityfocus.com/archive/1/485458/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/30924/

CVE-2007-6574

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect