VulnerabilityModified

CVE-2010-2849

Cross-site scripting (XSS) vulnerability in productionnu2/nuedit.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to inject arbitrary web script or HTML via the f parameter.

MEDIUM 4.3EPSS 2.07%

Does this matter?

Lower severity and a low EPSS score (2.07%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.07% probability · 81th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: nusoftware/nubuilder
Source: cve@mitre.org

EPSS trend

EPSS 2.1% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://cross-site-scripting.blogspot.com/2010/07/nubuilder-100420-reflected-xss.htmlExploit
http://packetstormsecurity.org/1007-exploits/nubuilder-xss.txtExploit
http://secunia.com/advisories/40483Vendor Advisory
http://www.nubuilder.com/nubuilderwww/change.php?changelog_id=14c3d1ea2a9fabPatch, Vendor Advisory
http://www.osvdb.org/66005Exploit
http://www.securityfocus.com/bid/41404Exploit
http://www.vupen.com/english/advisories/2010/1726Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/60137
http://cross-site-scripting.blogspot.com/2010/07/nubuilder-100420-reflected-xss.htmlExploit
http://packetstormsecurity.org/1007-exploits/nubuilder-xss.txtExploit
http://secunia.com/advisories/40483Vendor Advisory
http://www.nubuilder.com/nubuilderwww/change.php?changelog_id=14c3d1ea2a9fabPatch, Vendor Advisory
http://www.osvdb.org/66005Exploit
http://www.securityfocus.com/bid/41404Exploit
http://www.vupen.com/english/advisories/2010/1726Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/60137

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.