Description
Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute in a URL BBcode tag in a private message.
References
- 20081208 [DSECRG-08-041] Stored XSS Vulnerability in Xoops 2.3.x mailing-list
- 32685 vdb-entry
- 33048 third-party-advisory
- 50574 vdb-entry
- http://www.xoops.org/modules/news/article.php?storyid=4563
- http://www.xoops.org/modules/news/article.php?storyid=4540