CVE-2005-3959

Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site, (2) jsref, (3) jsres, and (4) jscolor parameters to pixel.php, which are not sanitized before being included in the logdb.html file, and (5) the search key to stat.php.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.78% chance of exploitation in the next 30 days, 92nd percentile

Published

2005-12-01

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/26635

Security advisories

• http://secunia.com/advisories/17783
• http://www.ush.it/2005/11/25/free-web-stat
• http://www.securityfocus.com/bid/15601

References

• CVE Record
• NVD entry