Description
Multiple cross-site scripting (XSS) vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorx and (2) newsx parameters.
References
- 699 third-party-advisory
- http://evuln.com/vulns/113/description.html
- 17335 vdb-entry
- qlnews-news-xss(25546) vdb-entry
- 19479 third-party-advisory
- 20060412 [eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities mailing-list
- 24290 vdb-entry