Unscored CVE-2002-2330 EUVD-2002-2308GHSA-8wrm-x7j4-2w7c

Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1…

Published Oct 26, 2007 · Updated Sep 16, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers.

References

statsplus-stat-script-injection(9678) vdb-entry
5316 vdb-entry
20020725 Uninets StatsPlus 1.25 script injection vulnerabilities mailing-list