CVE-2009-3513

Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group (PG) eTraining allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to courses_login.php, the id parameter to (2) news_read.php or (3) lessons_login.php, or (4) the cur parameter in a start action to lessons_login.php.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2009-10-01

Last modified

2024-08-07

Weaknesses

CWE-79

Affected products

• Pg Etraining (Pilotgroup)

References

• http://packetstormsecurity.org/0907-exploits/etraining-xss.txt
• http://www.securityfocus.com/bid/35834
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52072