Unscored severity · published Nov 30, 2011
CVE-2011-4647
Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geeklog · Geeklog
1.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4647
Patch
http://osvdb.org/76297
Exploit
http://project.geeklog.net/cgi-bin/hgwebdir.cgi/geeklog/rev/fd3ca3aebf86
project.geeklog.net
http://project.geeklog.net/tracking/view.php?id=1368
Vendor Advisory
http://secunia.com/advisories/46348/
Patch
http://www.geeklog.net/article.php/geeklog-1.8.1
More from Geeklog
4.8
CVE-2023-46058
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the…
4.8
CVE-2023-46059
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL…
4.8
CVE-2023-37787
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and…
4.8
CVE-2023-37786
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail…
–
CVE-2013-1470
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject…