Unscored severity · published Feb 16, 2015
CVE-2015-1435
Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php
–
CVSS
2.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MY Little Forum · Mylittleforum
through 2.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1435
Vendor Advisory
http://mylittleforum.net/forum/index.php?id=8182
Exploit
http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html
Exploit
http://www.securityfocus.com/archive/1/534681/100/0/threaded
Exploit
http://www.securityfocus.com/bid/72582
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100856
Exploit
https://www.htbridge.com/advisory/HTB23248
More from MY Little Forum
9.1
CVE-2026-25923
Phar Deserialization leading to Arbitrary File Deletion in my little forum
6.5
CVE-2019-12253
my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting
6.5
CVE-2018-15569
my little forum 2.4.12 allows CSRF for deletion of users
4.8
CVE-2018-14936
The Add page option in my little forum 2.4.12 allows XSS via the Title field
4.8
CVE-2018-14937
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field