CVE-2005-0477

Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2005-03-30

Last modified

2024-08-07

Weaknesses

CWE-79

Affected products

• Invision Power Board (Invision Power Services)

References

• http://marc.info/?l=bugtraq&m=110868196922995&w=2
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19399