CVE-2005-4627

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in index.php in (1) GmailSite 1.0 through 1.0.4 and (2) GFHost 0.1.1 through 0.4.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://foros.ojobuscador.com/tema1936.htmlExploit
http://lostmon.blogspot.com/2005/12/gmailsite-variable-cross-site.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18155Vendor Advisory
http://www.osvdb.org/22083
http://www.securityfocus.com/bid/16081Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/23912
http://foros.ojobuscador.com/tema1936.htmlExploit
http://lostmon.blogspot.com/2005/12/gmailsite-variable-cross-site.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18155Vendor Advisory
http://www.osvdb.org/22083
http://www.securityfocus.com/bid/16081Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/23912

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-46287.5SQL injection vulnerability in index.php in HelpDeskPoint 2.38 and earlier allows remote attackers to execute arbitrary SQL commands via the CVE-2005-46297.5SQL injection vulnerability in SMBCMS 2.1 allows remote attackers to execute arbitrary SQL commands via unspecified search parameters.CVE-2005-46307.5SQL injection vulnerability in index.php in ClientExec 2.3 allows remote attackers to execute arbitrary SQL commands via the (1) billshowid,CVE-2005-46317.5SQL injection vulnerability in index.php in Zina 0.12.07 and earlier allows remote attackers to execute arbitrary SQL commands via the p par CVE-2005-46327.5SQL injection vulnerability in poll_frame.php in Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the CVE-2005-46347.5SQL injection vulnerability in index.php in ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the CVE-2005-46355.0The nl_fib_input function in fib_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload, wh CVE-2005-46364.6OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyp CVE-2005-46374.3Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject CVE-2005-46385.0index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to obtain the full path via (1) _a and (2) newsid parameters in CVE-2005-46394.6Buffer overflow in the CA-driver (dst_ca.c) for TwinHan DST Frontend/Card in Linux kernel 2.6.12 and other versions before 2.6.15 allows loc CVE-2005-46407.5SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands