Unscored severity · published Dec 21, 2005
CVE-2005-4432
Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the err parameter
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the err parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Playsms · Playsms
0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4432
marc.info
http://marc.info/?l=full-disclosure&m=113478814326427&w=2
marc.info
http://marc.info/?l=full-disclosure&m=113970096305873&w=2
Vendor Advisory
http://secunia.com/advisories/18148
www.osvdb.org
http://www.osvdb.org/21835
www.securityfocus.com
http://www.securityfocus.com/bid/15928
www.vupen.com
http://www.vupen.com/english/advisories/2006/0548
More from Playsms
9.8
CVE-2020-8644
PlaySMS Server-Side Template Injection Vulnerability
9.8
CVE-2024-8880
playSMS Template index.php code injection
9.8
CVE-2022-47034
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication
9.8
CVE-2021-40373
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the…
9.8
CVE-2017-9101
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file