Description
Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript.
References
- xmb-swf-geturl-xss(25737) vdb-entry
- 17445 vdb-entry
- 20060409 XMB Forum 1.9.5-Final XSS mailing-list
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History