CVE-2002-1459

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to insert arbitrary script or HTML via message fields including (1) From, (2) E-Mail, and (3) Subject.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.htmlPatch, Vendor Advisory
http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278Patch
http://sourceforge.net/tracker/index.php?func=detail&aid=579278&group_id=53716&atid=471343Patch, Vendor Advisory
http://www.iss.net/security_center/static/9838.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5462Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.htmlPatch, Vendor Advisory
http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278Patch
http://sourceforge.net/tracker/index.php?func=detail&aid=579278&group_id=53716&atid=471343Patch, Vendor Advisory
http://www.iss.net/security_center/static/9838.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/5462Patch, Vendor Advisory

Timeline

Published: Jun 9, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-14605.0L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST (attachment, a CVE-2002-14617.5Web Shop Manager 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box.CVE-2002-14625.0details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by m CVE-2002-14637.5Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor Models 500/700/1000 and 1100/1200/1300, and Gateway CVE-2002-14646.8Cross-site scripting (XSS) vulnerability in CafeLog b2 Weblog Tool allows remote attackers to insert arbitrary HTML or script via the GPC va CVE-2002-14657.5SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.CVE-2002-146610.0CafeLog b2 Weblog Tool 2.06pre4, with allow_fopen_url enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable.CVE-2002-14675.0Macromedia Flash Plugin before 6,0,47,0 allows remote attackers to bypass the same-domain restriction and read arbitrary files via (1) an HT CVE-2002-146810.0Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.CVE-2002-14697.5scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users CVE-2002-14702.1SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes CVE-2002-14715.0The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previ