Description
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a browse action, (4) now parameter, or (5) search parameter in a search_results action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (3)
References (3)
Core 3
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/28219
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41198
Patch x_refsource_confirm
http://download.redgalaxy.net/?nav=home
Scores
EPSS
0.0012
EPSS Percentile
30.6%
Details
CWE
CWE-79
Status
published
Products (1)
redgalaxy/download_center
1.2
Published
Sep 01, 2009
Tracked Since
Feb 18, 2026