Vulnerability in Phorum

CVE-2005-2836

Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.

EPSS: 0.013 (66.5th percentile) — read the EPSS interpretation.

Affected products

  • Phorum — versions 3.1, 3.1.1, 3.1.1_pre
  • N/a — versions n/a

References

  • cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
  • cve@mitre.org (Vendor Advisory, mailing-list, Exploit, Patch, x_refsource_FULLDISC)
  • cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_FULLDISC)