CVEvulnerability
CVE-2009-4786
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-04-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to (1) admin/admin_config.php, (2) admin/admin_modules.php, (3) delete.php, (4) editlink.php, (5) submit.php, (6) submit_groups.php, (7) user_add_remove_links.php, and (8) user_settings.php.
Affected configurations
• pligg pligg cms (<= 1.0.2)
• pligg pligg cms 1.0.0
• pligg pligg cms 1.0.1
• pligg pligg cms 9.5
• pligg pligg cms 9.9
• pligg pligg cms 9.9.0
• pligg pligg cms 9.9.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://holisticinfosec.org/content/view/130/45/ holisticinfosec.org
- http://secunia.com/advisories/37349 Vendor Advisory
- http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/ Patch, Vendor Advisory
- http://holisticinfosec.org/content/view/130/45/ holisticinfosec.org
- http://secunia.com/advisories/37349 Vendor Advisory
- http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/ Patch, Vendor Advisory