CVE-2007-0175

B2evolution - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirect_to parameter.

References (7)

[Issue Tracking] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=410568

[Third Party Advisory, VDB Entry] http://osvdb.org/32027

[Vendor Advisory] http://secunia.com/advisories/23656

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/31368

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/21953

[Third Party Advisory] http://www.debian.org/security/2008/dsa-1568

[Third Party Advisory] http://secunia.com/advisories/30093

Scores

EPSS 0.0053

EPSS Percentile 66.8%

Classification

CWE

CWE-79

Status draft

Affected Products (3)

b2evolution/b2evolution

Timeline

Published Jan 11, 2007

Tracked Since Feb 18, 2026