CVE-2005-3552

Published: Nov 16, 2005Modified: Apr 16, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple vectors in (1) login/profile.php, (2) login/userinfo.php, (3) admin/admin.php, (4) imcenter.php, and the (5) referer statistics, the (6) HTML title element and (7) logo alt attributes in forum postings, and the (8) Homepage field in the Guestbook.

Affected (1)

Products: Phpkit: Phpkit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Phpkit Phpkit	Up to 1.6.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (38)

http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html

Source: cve@mitre.org

http://secunia.com/advisories/17479

Source: cve@mitre.org

http://securitytracker.com/id?1015167

Source: cve@mitre.org

http://www.hardened-php.net/advisory_212005.80.html

Source: cve@mitre.org

Vendor Advisory

http://www.osvdb.org/20553

Source: cve@mitre.org

http://www.osvdb.org/20554

Source: cve@mitre.org

http://www.osvdb.org/20555

Source: cve@mitre.org

http://www.osvdb.org/20556

Source: cve@mitre.org

http://www.osvdb.org/20557

Source: cve@mitre.org

http://www.osvdb.org/20558

Source: cve@mitre.org

http://www.osvdb.org/20559

Source: cve@mitre.org

http://www.securityfocus.com/bid/15354

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2005/2344

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/23003

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23004

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23006

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23007

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23008

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23009

Source: cve@mitre.org

http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/17479

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1015167

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.hardened-php.net/advisory_212005.80.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.osvdb.org/20553

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20554

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20555

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20556

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20557

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20558

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/20559

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/15354

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2005/2344

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/23003

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23004

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23006

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23007

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23008

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23009

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.