CVE-2005-4799

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Homepage field (aka the Website field) in an "image-related comment" and (2) the img_size field in view.php. NOTE: due to lack of details from the researcher, it is not clear whether the comment vector overlaps CVE-2005-1886.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2005-10/0161.htmlExploit, Vendor Advisory
http://secunia.com/advisories/17041Exploit, Vendor Advisory
http://www.osvdb.org/19958
http://www.osvdb.org/19959
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0510-001.txtExploit, Vendor Advisory
http://www.securityfocus.com/bid/15092Exploit
http://www.securityfocus.com/bid/15095
https://exchange.xforce.ibmcloud.com/vulnerabilities/22750
https://exchange.xforce.ibmcloud.com/vulnerabilities/22752
http://archives.neohapsis.com/archives/bugtraq/2005-10/0161.htmlExploit, Vendor Advisory
http://secunia.com/advisories/17041Exploit, Vendor Advisory
http://www.osvdb.org/19958
http://www.osvdb.org/19959
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0510-001.txtExploit, Vendor Advisory
http://www.securityfocus.com/bid/15092Exploit
http://www.securityfocus.com/bid/15095
https://exchange.xforce.ibmcloud.com/vulnerabilities/22750
https://exchange.xforce.ibmcloud.com/vulnerabilities/22752

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-48009.0Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administra CVE-2005-48017.5Multiple cross-site request forgery (CSRF) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers CVE-2005-48024.6Flexbackup 1.2.1 and earlier allows local users to overwrite files and execute code via a symlink attack on temporary files. NOTE: the raw CVE-2005-48033.6graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files. NOTE: this issue was origina CVE-2005-48045.0Unspecified vulnerability in Sun Java System Application Server Platform Edition and Enterprise Edition 8.1 2005 Q1, and Platform Edition UR CVE-2005-48055.0Unspecified vulnerability in Sun Java System Application Server 7 Standard and Platform Edition 6 and earlier, and 2004Q2 Standard and Platf CVE-2005-48065.0Multiple unspecified vulnerabilities in Sun Java System Web Proxy Server 3.6 SP7 and earlier allow remote attackers to cause a denial of ser CVE-2005-48077.5Stack-based buffer overflow in the as_bad function in messages.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils befo CVE-2005-48087.6Buffer overflow in reset_vars in config/tc-crx.c in the GNU as (gas) assembler in Free Software Foundation GNU Binutils before 20050714 allo CVE-2005-48095.0Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status CVE-2005-48105.0Microsoft Internet Explorer 7.0 Beta3 and earlier allows remote attackers to cause a denial of service (crash) via a "text/html" HTML Conten CVE-2005-48114.9The hugepage code (hugetlb.c) in Linux kernel 2.6, possibly 2.6.12 and 2.6.13, in certain configurations, allows local users to cause a deni