GHSA-GJ36-CQ98-VQC6

Vulnerability from github – Published: 2022-05-17 01:52 – Updated: 2025-04-11 03:53
VLAI
Details

Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-3835"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-12-24T19:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.",
  "id": "GHSA-gj36-cq98-vqc6",
  "modified": "2025-04-11T03:53:45Z",
  "published": "2022-05-17T01:52:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3835"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71899"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71902"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71906"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77914"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77920"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77921"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77922"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77923"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77924"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77925"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77926"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77927"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77928"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77929"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77930"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77931"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77932"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77933"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77934"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77935"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77936"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77937"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/77938"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/46163"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/secunia_research/2011-84"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/secunia_research/2011-86"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.