CVE-2015-2198

Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2015-03-03

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Beehive Forum (Beehive Forum)

References

• http://sourceforge.net/p/beehiveforum/news/2015/02/beehive-forum-145-released/
• http://www.exploit-db.com/exploits/36154