Unscored severity · published Dec 29, 2011
CVE-2011-5025
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to…
–
CVSS
2.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) the index parameter to showOldPage.yaws, (3) the node parameter to allRefsToMe.yaws, or (4) the text parameter to editPage.yaws.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
Yaws · Yaws
1.88 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-5025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-5025
www.securityfocus.com
http://www.securityfocus.com/bid/51276
URL Repurposed
https://sitewat.ch/Advisory/View/4
More from Yaws
9.8
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection
9.8
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection
7.5
CVE-2017-10974
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080
6.5
CVE-2011-4350
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed
6.1
CVE-2016-1000108
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…