CVE-2005-2853

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to printfaq.php, or the (2) Referer or (3) User-Agent HTTP headers, which are not properly handled by error.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16707Patch, Vendor Advisory
http://www.freeguppy.org/download.php?lng=enPatch
http://www.freeguppy.org/thread.php?lng=en&pg=81882&fid=1&cat=200
http://www.securityfocus.com/bid/14753Patch
http://secunia.com/advisories/16707Patch, Vendor Advisory
http://www.freeguppy.org/download.php?lng=enPatch
http://www.freeguppy.org/thread.php?lng=en&pg=81882&fid=1&cat=200
http://www.securityfocus.com/bid/14753Patch

Timeline

Published: Sep 8, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-28545.0CRLF injection vulnerability in thesitewizard.com chfeedback.pl Feedback Form Perl Script 2.0.1 allows remote attackers to use the script as CVE-2005-28554.3Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3 allows remote attackers to inject arbitrary web script or HTML via CVE-2005-28567.5Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including CVE-2005-28577.5Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy).CVE-2005-28585.0The Fetch.FetchContact.1 ActiveX control (Fetch.dll) for Rediff Bol 7.0 allows remote attackers to read the Windows Address Book via the Ful CVE-2005-28594.6Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges.CVE-2005-28604.3Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Se CVE-2005-28614.3Cross-site scripting (XSS) vulnerability in N-Stealth Commercial Edition before 5.8.0.38 and Free Edition before 5.8.1.03 allows remote atta CVE-2005-28627.5ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a b CVE-2005-28634.3Cross-site scripting (XSS) vulnerability in openwebmail-main.pl in OpenWebMail 2.41 allows remote attackers to inject arbitrary web script o CVE-2005-28642.1URBAN 1.5.3_1 allows local users to overwrite arbitrary files via a symlink attack on the (1) high score or (2) save game files.CVE-2005-28657.5Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the config[