VulnerabilityModified
CVE-2007-1248
Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
MEDIUM 4.3EPSS 1.77%
Does this matter?
Lower severity and a low EPSS score (1.77%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.77% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- built2go/news manager blog
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/24334Vendor Advisory
- http://securityreason.com/securityalert/2343
- http://www.securityfocus.com/archive/1/461672/100/0/threaded
- http://www.securityfocus.com/bid/22783Exploit
- http://www.vupen.com/english/advisories/2007/0818
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32772
- http://secunia.com/advisories/24334Vendor Advisory
- http://securityreason.com/securityalert/2343
- http://www.securityfocus.com/archive/1/461672/100/0/threaded
- http://www.securityfocus.com/bid/22783Exploit
- http://www.vupen.com/english/advisories/2007/0818
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32772
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.