Unscored severity · published Nov 26, 2012
CVE-2010-5284
Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php, (2) y parameter in a newcal action to manageajax.php, and the (3) pic parameter to thumb.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Collabtive · O-dyn
0.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5284
packetstormsecurity.org
http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt
Vendor Advisory
http://secunia.com/advisories/41805
www.anatoliasecurity.com
http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt
www.exploit-db.com
http://www.exploit-db.com/exploits/15240
Exploit
http://www.securityfocus.com/bid/44050
More from Collabtive
9.8
CVE-2013-5027
Collabtive 1.0 has incorrect access control
8.8
CVE-2015-0258
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary…
6.1
CVE-2020-13655
An issue was discovered in Collabtive 3.0 and later
5.4
CVE-2024-48708
Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action =…
5.4
CVE-2024-48707
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within…