National Cyber Awareness System

Vulnerability Summary for CVE-2011-3835

Overview

Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: wuzly-referer-header-xss(71906)

Hyperlink:http://xforce.iss.net/xforce/xfdb/71906

External Source: XF

Name: wuzly-login-xss(71902)

Hyperlink:http://xforce.iss.net/xforce/xfdb/71902

External Source: XF

Name: wuzly-multiple-xss(71899)

Hyperlink:http://xforce.iss.net/xforce/xfdb/71899

External Source: MISC

Name: http://secunia.com/secunia_research/2011-86/

Type: Advisory

Hyperlink:http://secunia.com/secunia_research/2011-86/

External Source: MISC

Name: http://secunia.com/secunia_research/2011-84/

Type: Advisory

Hyperlink:http://secunia.com/secunia_research/2011-84/

External Source: SECUNIA

Name: 46163

Hyperlink:http://secunia.com/advisories/46163

External Source: OSVDB

Name: 77938

Hyperlink:http://osvdb.org/77938

External Source: OSVDB

Name: 77937

Hyperlink:http://osvdb.org/77937

External Source: OSVDB

Name: 77936

Hyperlink:http://osvdb.org/77936

External Source: OSVDB

Name: 77935

Hyperlink:http://osvdb.org/77935

External Source: OSVDB

Name: 77934

Hyperlink:http://osvdb.org/77934

External Source: OSVDB

Name: 77933

Hyperlink:http://osvdb.org/77933

External Source: OSVDB

Name: 77932

Hyperlink:http://osvdb.org/77932

External Source: OSVDB

Name: 77931

Hyperlink:http://osvdb.org/77931

External Source: OSVDB

Name: 77930

Hyperlink:http://osvdb.org/77930

External Source: OSVDB

Name: 77929

Hyperlink:http://osvdb.org/77929

External Source: OSVDB

Name: 77928

Hyperlink:http://osvdb.org/77928

External Source: OSVDB

Name: 77927

Hyperlink:http://osvdb.org/77927

External Source: OSVDB

Name: 77926

Hyperlink:http://osvdb.org/77926

External Source: OSVDB

Name: 77925

Hyperlink:http://osvdb.org/77925

External Source: OSVDB

Name: 77924

Hyperlink:http://osvdb.org/77924

External Source: OSVDB

Name: 77923

Hyperlink:http://osvdb.org/77923

External Source: OSVDB

Name: 77922

Hyperlink:http://osvdb.org/77922

External Source: OSVDB

Name: 77921

Hyperlink:http://osvdb.org/77921

External Source: OSVDB

Name: 77920

Hyperlink:http://osvdb.org/77920

External Source: OSVDB

Name: 77914

Hyperlink:http://osvdb.org/77914