CVE-2006-0880

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2006-02-24

Last modified

2024-08-07

Affected products

• Noahs Classifieds (Phpoutsourcing)

References

• http://securitytracker.com/id?1015667
• http://www.kapda.ir/advisory-268.html
• http://www.securityfocus.com/archive/1/425783/100/0/threaded
• http://www.securityfocus.com/bid/16772
• http://www.vupen.com/english/advisories/2006/0703
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24895