CVE-2005-2254 | BDVDB-2026-11380 Detail

Description#

Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php, or (3) the auction_id parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product, so they are not included in this description.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://securitytracker.com/id?1014423
http://secunia.com/advisories/15967

Exploit#

No public exploit known

History#

Version 12005-07-13Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.