CVE-2005-4307

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-17 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to (1) forum.cgi and (2) post.cgi, or (3) the user parameter to profile.cgi.

Affected products

Jonathan Bravata Scarecrow: through 2.13; 2.00_beta, 2.01_beta, 2.10, 2.11, 2.12

References

http://pridels0.blogspot.com/2005/12/scarecrow-message-board-xss-vuln.html
http://secunia.com/advisories/18084
http://www.osvdb.org/21777
http://www.osvdb.org/21778
http://www.osvdb.org/21779
http://www.securityfocus.com/bid/15915
http://www.vupen.com/english/advisories/2005/2937
http://pridels0.blogspot.com/2005/12/scarecrow-message-board-xss-vuln.html
http://secunia.com/advisories/18084
http://www.osvdb.org/21777
http://www.osvdb.org/21778
http://www.osvdb.org/21779

Get alerted when CVE-2005-4307 or the next vulnerability affects your stack