CVE-2007-5985

BtiTracker <1.4.5 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php, (2) moresmiles.php, or (3) recover.php; or (4) the "to" parameter to usercp.php.

References (15)

[Patch, Vendor Advisory] http://secunia.com/advisories/27550

[Patch] http://sourceforge.net/forum/forum.php?forum_id=752472

[Product] http://sourceforge.net/project/shownotes.php?group_id=146822&release_id=552477

[Product] http://sourceforge.net/tracker/index.php?func=detail&aid=1753797&group_id=146822&atid=766508

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/38413

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26551

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/38414

[Third Party Advisory, VDB Entry] http://osvdb.org/38751

[Third Party Advisory, VDB Entry] http://osvdb.org/38752

[Third Party Advisory, VDB Entry] http://osvdb.org/38753

[Third Party Advisory, VDB Entry] http://osvdb.org/38754

[Third Party Advisory, VDB Entry] http://osvdb.org/42219

[Third Party Advisory, VDB Entry] http://osvdb.org/42220

[Third Party Advisory, VDB Entry] http://osvdb.org/42221

[Third Party Advisory, VDB Entry] http://osvdb.org/42222

Scores

EPSS 0.0076

EPSS Percentile 73.2%

Classification

CWE

CWE-79

Status draft

Affected Products (1)

bti-tracker/bti-tracker < 1.3.2

Timeline

Published Nov 15, 2007

Tracked Since Feb 18, 2026