Unscored severity · published Dec 1, 2005
CVE-2005-3955
Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to…
–
CVSS
5.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blogbuddies · Blogbuddies
0.3 · source: NVD
JA
Jaws · Jaws
0.6.2 · source: NVD
MA
Magpierss · Magpierss
7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3955
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3955
retrogod.altervista.org
http://retrogod.altervista.org/JAWS_062_sql.html
seclists.org
http://seclists.org/fulldisclosure/2015/May/35
Patch
http://secunia.com/advisories/17741
Vendor Advisory
http://secunia.com/advisories/20842
securitytracker.com
http://securitytracker.com/id?1015264
Patch
http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847
More from Blogbuddies
–
CVE-2005-3954
Cross-site scripting (XSS) vulnerability in blogBuddies 0.3 allows remote attackers to inject arbitrary web script or HTML via the u parameter to index.php