Published: 11/09/2014 Updated: 29/08/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 445

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS prior to 2.5.5 allow remote malicious users to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xoops xoops 2.5.2
xoops xoops 2.5.3
xoops xoops
xoops xoops 2.5.0
xoops xoops 2.5.1

XOOPS version 254 suffers from multiple cross site scripting vulnerabilities ...

source: wwwsecurityfocuscom/bid/53143/info XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the at ...

source: wwwsecurityfocuscom/bid/53143/info XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the atta ...

Advisory ID: HTB23062 Product: XOOPS Vendor: xoopsorg Vulnerable Version(s): 254 and probably prior Tested Version: 254 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability Type: XSS (Cross Site Scripting) CVE Reference(s): CVE-2012-0984 Solution Status: Fixed by Vendor Risk Le ...

CWE-79 http://osvdb.org/81212 http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html http://xoops.org/modules/news/article.php?storyid=6284 http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html http://secunia.com/advisories/48887 http://osvdb.org/81213 https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html http://www.exploit-db.com/exploits/18753 http://www.securityfocus.com/bid/53143 https://exchange.xforce.ibmcloud.com/vulnerabilities/75024 https://nvd.nist.gov https://packetstormsecurity.com/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html https://www.exploit-db.com/exploits/37093/

CVE-2012-0984

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect