CVE-2011-3686

Multiple cross-site scripting (XSS) vulnerabilities in myAddressBook.asp in Sonexis ConferenceManager 9.2.11.0 and 9.3.14.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, (3) email_edit, (4) email, (5) email2, (6) email3, (7) sms, (8) sms_id, or (9) work parameter.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2011-09-27

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Conferencemanager (Sonexis)

References

• http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-XSS-Vulnerabilities.html