Description
Multiple cross-site scripting (XSS) vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to inject arbitrary web script or HTML via (1) the val parameter to alphabet.php in an alpha.albums action, or the PATH_INFO to (2) random.php or (3) admin/hidden.php.
References
- 38402 vdb-entry
- netjuke-alphabet-xss(36517) vdb-entry
- 38403 vdb-entry
- 20070908 Netjuke 1.0-rc2 - sql injection & XSS mailing-list
- 38404 vdb-entry
- 3110 third-party-advisory
- 25599 vdb-entry