CVE-2010-2463

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify action.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/40259Vendor Advisory
http://www.htbridge.ch/advisory/xss_vulnerability_in_jamroom.htmlExploit
http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1756Vendor Advisory
http://www.securityfocus.com/bid/41071Exploit
http://secunia.com/advisories/40259Vendor Advisory
http://www.htbridge.ch/advisory/xss_vulnerability_in_jamroom.htmlExploit
http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1756Vendor Advisory
http://www.securityfocus.com/bid/41071Exploit

Timeline

Published: Jun 25, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-24644.3Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla! allow remote attack CVE-2010-24655.0The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information un CVE-2010-24665.0The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent d CVE-2010-24675.0The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a CVE-2010-246810.0The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storin CVE-2010-24695.0The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obt CVE-2010-24701.9Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions wit CVE-2010-24716.1Drupal versions 5.x and 6.x has open redirection CVE-2010-24724.8Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of languag CVE-2010-24736.5Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session th CVE-2010-24743.5JBoss Enterprise Service Bus (ESB) before 4.7 CP02 in JBoss Enterprise SOA Platform before 5.0.2 does not properly consider the security dom CVE-2010-24769.8syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open based