CVE-2008-2022

Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) toid parameter to send-private-message.asp and the (2) redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.47% chance of exploitation in the next 30 days, 88th percentile

Published

2008-04-30

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/5507

References

• CVE Record
• NVD entry

Related

• CVE-2008-2019
• CVE-2008-2023
• CVE-2008-2018
• CVE-2008-2024
• CVE-2008-2015
• CVE-2008-2028