Login Request a demo
Unscored severity · published Sep 8, 2005
CVE-2005-2853
Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to printfaq.php, or the (2) Referer or (3) User-Agent HTTP headers, which are not properly handled by error.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
Guppy · Guppy
4.5; 4.5.3; 4.5.3a · source: NVD
Affected product
GU
Guppy
Guppy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2853
Patch
http://secunia.com/advisories/16707
Patch
http://www.freeguppy.org/download.php?lng=en
www.freeguppy.org
http://www.freeguppy.org/thread.php?lng=en&pg=81882&fid=1&cat=200
Patch
http://www.securityfocus.com/bid/14753
More from Guppy
–
CVE-2013-5983
Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php…
–
CVE-2007-5845
Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a
–
CVE-2007-5844
Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a
–
CVE-2007-1451
GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" (cleanup.php) and then "Suppression…
–
CVE-2007-0639
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .inc file in the data/ directory…