CVE-2010-4734

EUVD-2010-4699
Multiple cross-site scripting (XSS) vulnerabilities in the comment feature in Skeletonz CMS 1.0, when the Blog plugin is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Email parameters.  NOTE: some of these details are obtained from third party information.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
amixskeletonz_cms_1.0
*
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.org/files/view/96151/skeletonzcms-xss.txt
http://secunia.com/advisories/42385
http://securityreason.com/securityalert/8081
http://www.exploit-db.com/exploits/15625
http://www.osvdb.org/69514
http://www.securityfocus.com/bid/45081
http://packetstormsecurity.org/files/view/96151/skeletonzcms-xss.txt
http://secunia.com/advisories/42385
http://securityreason.com/securityalert/8081
http://www.exploit-db.com/exploits/15625
http://www.osvdb.org/69514
http://www.securityfocus.com/bid/45081