Description
Cross-site scripting (XSS) vulnerability in news.php in VARIOMAT allows remote attackers to inject arbitrary HTML or web script via the subcat parameter. NOTE: this issue might be resultant from SQL injection.
References
- variomat-news-xss(26877) vdb-entry
- 999 third-party-advisory
- 20060528 VARIOMAT(advanced cms tool)SQL injection/XSS mailing-list