Description
Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple vectors in (1) login/profile.php, (2) login/userinfo.php, (3) admin/admin.php, (4) imcenter.php, and the (5) referer statistics, the (6) HTML title element and (7) logo alt attributes in forum postings, and the (8) Homepage field in the Guestbook.
References
- phpkit-profile-userinfo-xss(23003) vdb-entry
- phpkit-imcenter-xss(23008) vdb-entry
- 1015167 vdb-entry
- 20553 vdb-entry
- 15354 vdb-entry
- phpkit-referer-xss(23006) vdb-entry
- 20558 vdb-entry
- phpkit-html-tags-xss(23007) vdb-entry
- 20051105 Advisory 21/2005: Multiple vulnerabilities in PHPKIT mailing-list
- phpkit-guestbook-xss(23009) vdb-entry
- 20555 vdb-entry
- ADV-2005-2344 vdb-entry
- 20554 vdb-entry
- 20559 vdb-entry
- 17479 third-party-advisory
- http://www.hardened-php.net/advisory_212005.80.html
- 20556 vdb-entry
- phpkit-admin-xss(23004) vdb-entry
- 20557 vdb-entry