Description
Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inject arbitrary web script or HTML, probably via arbitrary parameters in the query string, as demonstrated with a vigilon parameter. NOTE: earlier downloads of 1.3.36 have the vulnerability; the software was updated without changing the version number.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Vigilon · textwebappsphp
https://www.exploit-db.com/exploits/28882
References (7)
Core 7
Core References
Various Sources x_refsource_misc
http://www.vigilon.com/advisories/vg-phpfaber-24-10-2006.txt
Exploit, Patch, Vendor Advisory x_refsource_misc
http://www.vigilon.com/resources/102506c.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/20821
Exploit, Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22629
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/1802
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4260
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/449894/100/0/threaded
Scores
EPSS
0.0931
EPSS Percentile
92.8%
Details
Status
published
Products (1)
phpfaber/phpfaber_content_management_system
< 1.3.36
Published
Oct 31, 2006
Tracked Since
Feb 18, 2026