CVE-2005-1886

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15600/Vendor Advisory
http://securitytracker.com/id?1014103Exploit, Vendor Advisory
http://secwatch.org/advisories/secwatch/20050530_yapig.txtExploit, Vendor Advisory
http://www.osvdb.org/17118
http://www.securityfocus.com/bid/13875Exploit
http://www.securityfocus.com/bid/13876Exploit
http://secunia.com/advisories/15600/Vendor Advisory
http://securitytracker.com/id?1014103Exploit, Vendor Advisory
http://secwatch.org/advisories/secwatch/20050530_yapig.txtExploit, Vendor Advisory
http://www.osvdb.org/17118
http://www.securityfocus.com/bid/13875Exploit
http://www.securityfocus.com/bid/13876Exploit

Timeline

Published: Jun 9, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-18874.6Unknown vulnerability in the Sun Solaris C library (libc and libproject) in Solaris 10 allows local users to gain privileges.CVE-2005-18884.3Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attribute CVE-2005-18895.0Unknown vulnerability in Sun ONE Application Server 6.5 SP1 Maintenance Update 6 and earlier allows attackers to read files.CVE-2005-18905.0Unknown vulnerability in Mortiforo before 0.9.1 allows users to access private forums via unknown attack vectors.CVE-2005-18917.5The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (cra CVE-2005-18926.4FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.ph CVE-2005-18935.0FlatNuke 2.5.3 allows remote attackers to obtain sensitive information via invalid parameters to certain scripts, which leaks the web docume CVE-2005-18947.5Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Ref CVE-2005-18954.3Cross-site scripting (XSS) vulnerability in FlatNuke 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the border or CVE-2005-18965.0Directory traversal vulnerability in thumb.php in FlatNuke 2.5.3 allows remote attackers to read arbitrary images or obtain the installation CVE-2005-189710.0Unknown vulnerability in FlexCast Audio Video Streaming Server before 2.0 has unknown impact and attack vectors.CVE-2005-18985.0The passthrough functionality in phpThumb.php in phpThumb() before 1.5.4 allows remote attackers to read files that are not images.