Description
Multiple cross-site scripting (XSS) vulnerabilities in FullPhoto.asp in WS-Album 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) image and (2) PublisedDate parameters.
References
- 20537 third-party-advisory
- ADV-2006-2299 vdb-entry
- http://pridels0.blogspot.com/2006/06/ws-album-xss-vuln.html
- ws-album-fullphoto-xss(27056) vdb-entry
- 20060615 WS-Album - "PublisedDate" is correct, source verify, new vector mailing-list