4.3

CVE-2006-2084

Exploit
Multiple cross-site scripting (XSS) vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in (a) index.php, and the (3) mod parameter in (b) admin.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Farsinews ≫ Farsinews Version <= 2.5.3_pro
Farsinews ≫ Farsinews Version2.1
Farsinews ≫ Farsinews Version2.1_beta2
Farsinews ≫ Farsinews Version2.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.22% 0.647
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://securityreason.com/securityalert/812
http://www.aria-security.net/advisory/farsinews/farsinews0420062.txt
Exploit
http://www.securityfocus.com/archive/1/432109/100/0/threaded
http://www.securityfocus.com/bid/17701
https://exchange.xforce.ibmcloud.com/vulnerabilities/26097