medium4.3Public exploit code

CVE-2005-3556

Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lis…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PHPList Mailing List Manager 2.x - '/admin/users.php?find' Cross-Site Scripting2005-11-07 · webapps · php · Verified
PHPList Mailing List Manager 2.x - '/admin/configure.php?id' Cross-Site Scripting2005-11-07 · webapps · php · Verified
PHPList Mailing List Manager 2.x - '/admin/eventlog.php' Multiple Cross-Site Scripting Vulnerabilities2005-11-07 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c) admin/template.php, (4) filter, (5) delete, and (6) start parameters in (d) admin/eventlog.php, (7) id parameter in (e) admin/configure.php, (8) find parameter in (f) admin/users.php, (9) start parameter in (g) admin/admin.php, and (10) action parameter in (h) admin/fckphplist.php.

Affected products

Vendor	Product	Affected versions
Tincan	Phplist	through 2.10.1

Public exploit code

Impact

Affected products

References