| Package | Affected versions | Patched versions |
|---|---|---|
| xoops | = 2.0.13.2= 2.0.14= 2.0.15= 2.0.16= 2.0.17= 2.0.17.1= 2.0.18= 2.0.18.1= 2.0.18.2= 2.0.2= 2.3.0= 2.3.1= 2.3.2a= 2.3.2b= 2.3.3= 2.3.3b= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.5.0= 2.5.1≤ 2.5.1.a |
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free