CVE-2005-2836

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-09-07 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.

Affected products

Phorum: 3.1, 3.1.1, 3.1.1_pre, 3.1.1_rc2, 3.1.1a, 3.1.2 (+36)

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html
http://secunia.com/advisories/16667
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html
http://secunia.com/advisories/16667

Get alerted when CVE-2005-2836 or the next vulnerability affects your stack