CVE

Id
21233  
CVE No.
CVE-2006-5129  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) the message parameter, and possibly other parameters, in module/shout/jafshout.php (aka the shoutbox); and (2) the message body in a forum post in module/forum/topicwin.php, related to the name, email, title, date, ldate, and lname variables.  
Phase
Assigned (20061002)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
201870 21233 CVE-2006-5129 BUGTRAQ:20060926 JAF CMS 4.0 RC1 multiple vulnerabilities  View
201871 21233 CVE-2006-5129 URL:http://www.securityfocus.com/archive/1/archive/1/447081/100/0/threaded  View
201872 21233 CVE-2006-5129 BID:20225  View
201873 21233 CVE-2006-5129 URL:http://www.securityfocus.com/bid/20225  View
201874 21233 CVE-2006-5129 SECUNIA:22143  View
201875 21233 CVE-2006-5129 URL:http://secunia.com/advisories/22143  View
201876 21233 CVE-2006-5129 SREASON:1674  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
60987 JVNDB-2006-003253 ph03y3nk JAF CMS の module/shout/jafshout.php における "" で囲まれたセクション内の任意のコードを実行される脆弱性 ph03y3nk just another flat file (JAF) CMS の module/shout/jafshout.php は、admin/data_inc.php に関する静的コードを挿入される不備があるため、"" で囲まれたセクション内の任意のコードを実行される脆弱性が存在します。 CVE-2006-5131 21233 7.5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-003253.html  View