CVE-2005-2638

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) NewsMode parameter to NewsCategoryForm.php, or the (2) Match or (3) NewsMode parameter to SearchResults.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2005

CVE-2005-26397.5Buffer overflow in Chris Moneymaker's World Poker Championship 1.0 allows remote attackers to cause a denial of service (application crash) CVE-2005-26405.0Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authCVE-2005-26417.5Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain priCVE-2005-26427.5Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly duCVE-2005-26435.0Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral DiffieCVE-2005-26447.5Buffer overflow in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possiblCVE-2005-26457.5Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 CVE-2005-26466.4Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 CVE-2005-26474.3Cross-site scripting (XSS) vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, aCVE-2005-26485.0Directory traversal vulnerability in index.php in W-Agora 4.2.0 and earlier allows remote attackers to read arbitrary files via the site parCVE-2005-26494.3Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via (1) course paramCVE-2005-26504.3Cross-site scripting (XSS) vulnerability in sign.asp in Emefa Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML v