Unscored severity · published Aug 7, 2005
CVE-2005-2488
Cross-site scripting (XSS) vulnerability in Web Content Management News System allows remote attackers to inject arbitrary web script or HTML via (1) the strRootpath parameter to…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Web Content Management News System allows remote attackers to inject arbitrary web script or HTML via (1) the strRootpath parameter to validsession.php or (2) the strTable parameter to Admin/News/List.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
Web Content Management News System · Web Content Management
All versions, or not specified · source: NVD
Affected product
WC
Web Content Management News System
Web Content Management
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2488
Vendor Advisory
http://secunia.com/advisories/16317
Exploit
http://securitytracker.com/id?1014616
Exploit
http://www.rgod.altervista.org/webc.html
www.securityfocus.com
http://www.securityfocus.com/bid/14464
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/21689
More from Web Content Management News System
–
CVE-2005-2489
Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php