medium4.3Public exploit code
CVE-2009-2920
Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- elvin bts 1.2.2 - SQL Injection / Cross-Site Scripting2009-08-03 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) priority parameters to buglist.php; and the (3) Username (4) E-mail, (5) Pass, and (6) Confirm pass fields to createaccount.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elvinbts | Elvinbts | Version 1.2.2 |