CVE-2005-1290: XSS

Published Apr 26, 2005

Updated

Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u parameter to profile.php, (2) highlight parameter to viewtopic.php, or (3) forumname or forumdesc parameters to adminforums.php.

Affected Software

16 affected components

Phpbb Group Phpbb=2.0.5

Phpbb Group Phpbb=2.0.8

Phpbb Group Phpbb=2.0.11

Phpbb Group Phpbb=2.0.1

Phpbb Group Phpbb=2.0.13

Phpbb Group Phpbb=2.0.3

Phpbb Group Phpbb=2.0.4

Phpbb Group Phpbb=2.0.12

Phpbb Group Phpbb=2.0.9

Phpbb Group Phpbb=2.0.7

Phpbb Group Phpbb=2.0.8a

Phpbb Group Phpbb=2.0.2

Phpbb Group Phpbb=2.0.14

Phpbb Group Phpbb=2.0.10

Phpbb Group Phpbb=2.0.6

Phpbb Group Phpbb=2.0.0

Event History

Apr 26, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What are the XSS vulnerabilities in CVE-2005-1290?

CVE-2005-1290 identifies multiple cross-site scripting vulnerabilities in phpBB 2.0.14 and earlier versions, allowing attackers to inject arbitrary web scripts via specific parameters.

Which versions of phpBB are affected by CVE-2005-1290?

CVE-2005-1290 affects phpBB versions 2.0.0 through 2.0.14.

How can I mitigate CVE-2005-1290 vulnerabilities?

To mitigate CVE-2005-1290, upgrade phpBB to the latest version that addresses these XSS vulnerabilities.

What impact does CVE-2005-1290 have on phpBB installations?

The impact of CVE-2005-1290 includes the potential for remote attackers to execute unauthorized scripts, compromising the security of the phpBB installation.

Is there a patch available for CVE-2005-1290?

There is no individual patch for CVE-2005-1290; you must upgrade to a patched version of phpBB to resolve these vulnerabilities.