CVE-2011-5070
Sitracker Support Incident Tracker - XSS
Title source: ruleDescription
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref, linkref, linktype parameters, which are not properly handled in the clean_int function in lib/base.inc.php, or the redirect parameter, which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php.
References (7)
Scores
EPSS
0.0105
EPSS Percentile
77.4%
Classification
CWE
CWE-79
Status
published
Affected Products (2)
sitracker/support_incident_tracker
n/a/n/a
Timeline
Published
Jan 29, 2012
Tracked Since
Feb 18, 2026