CVE-2009-3227
Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action.
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- almondsoft/affiliate network classifieds · almondsoft/almond classifieds
- Source
- cve@mitre.org
References
- http://packetstormsecurity.org/0907-exploits/almondclassifiedsads-bsqlxss.txtExploit
- http://secunia.com/advisories/36003Vendor Advisory
- http://www.securityfocus.com/bid/35816Exploit
- http://packetstormsecurity.org/0907-exploits/almondclassifiedsads-bsqlxss.txtExploit
- http://secunia.com/advisories/36003Vendor Advisory
- http://www.securityfocus.com/bid/35816Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.