Unscored severity · published Dec 16, 2005
CVE-2005-4277
Cross-site scripting (XSS) vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter
–
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Toendacms · Toenda Software Development
through 0.6; 0.6_beta_1; 0.6_beta_2; 0.6_beta_3; 0.6_pre-beta · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4277
Vendor Advisory
http://secunia.com/advisories/18058
Exploit
http://securitytracker.com/id?1015354
www.osvdb.org
http://www.osvdb.org/21767
www.securityfocus.com
http://www.securityfocus.com/archive/1/435412/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/18178
Patch
http://www.toenda.com/files/toendaCMS_0.7_Beta.zip
More from Toendacms
–
CVE-2007-1872
Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search id
–
CVE-2006-4349
PHP remote file inclusion vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter to an…
–
CVE-2006-4016
Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script…
–
CVE-2006-3362
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka…
–
CVE-2006-2799
Cross-site scripting (XSS) vulnerability in content_footer.php in toendaCMS 0.7.0 allows remote attackers to inject arbitrary web scripts or HTML via the print_url variable