CVE-2011-1062

Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php. NOTE: some of these details are obtained from third party information.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.75% chance of exploitation in the next 30 days, 76th percentile

Published

2011-02-22

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/16158

ExploitDB entries (4)

• https://www.exploit-db.com/exploits/35338
• https://www.exploit-db.com/exploits/35337
• https://www.exploit-db.com/exploits/35336
• https://www.exploit-db.com/exploits/16158

References

• CVE Record
• NVD entry

Related

• CVE-2011-1060
• CVE-2011-1069
• CVE-2011-1055
• CVE-2011-1071
• CVE-2011-1048
• CVE-2011-1081