Unscored severity · published Oct 23, 2005
CVE-2005-3285
Cross-site scripting (XSS) vulnerability in comersus_backoffice_searchItemForm.asp in Comersus BackOffice Plus allows remote attackers to inject arbitrary web script or HTML via…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in comersus_backoffice_searchItemForm.asp in Comersus BackOffice Plus allows remote attackers to inject arbitrary web script or HTML via the (1) forwardTo1, (2) forwardTo2, (3) nameFT1, or (4) nameFT2 parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Comersus Backoffice Plus · Comersus Open Technologies
All versions, or not specified · source: NVD
Affected product
CB
Comersus Backoffice Plus
Comersus Open Technologies
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3285
Exploit
http://lostmon.blogspot.com/2005/10/comersus-backoffice-plus-cross-site.html
Vendor Advisory
http://secunia.com/advisories/17219
Exploit
http://securitytracker.com/id?1015064
www.osvdb.org
http://www.osvdb.org/20032
Exploit
http://www.securityfocus.com/bid/15118
More from Comersus Backoffice Plus
–
CVE-2005-3397
Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to…