Unscored severity · published Feb 4, 2015
CVE-2015-1475
Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2)…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to (a) board_entry.php or (b) forum_entry.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MY Little Forum · Mylittleforum
1.7; 2.2; 2.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1475
packetstormsecurity.com
http://packetstormsecurity.com/files/130220/My-Little-Forum-2.3.3-2.2-1.7-Cross-Site-Scripting.html
seclists.org
http://seclists.org/fulldisclosure/2015/Feb/15
tetraph.com
http://tetraph.com/security/xss-vulnerability/my-little-forum-multiple-xss-security-vulnerabilities/
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/100616
More from MY Little Forum
9.1
CVE-2026-25923
Phar Deserialization leading to Arbitrary File Deletion in my little forum
6.5
CVE-2019-12253
my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting
6.5
CVE-2018-15569
my little forum 2.4.12 allows CSRF for deletion of users
4.8
CVE-2018-14936
The Add page option in my little forum 2.4.12 allows XSS via the Title field
4.8
CVE-2018-14937
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field