CVE-2005-2254
Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php, or (3) the auction_id parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product, so they are not included in this description.
- Affected products
- Phpauction
- Gianluca Baldo Phpauction
- = 2.5
- Fix
- Available
- CVSS 2.0
- 4.3 MEDIUM
- EPSS
- 1.0% (59th percentile)
- Weakness
- CWE-79
- NVD status
- Modified
- Published
- 2005-07-13
CVE-2005-2254 at NVD
No indexed exploits for CVE-2005-2254 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2005-2254 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.