CVE-2005-2254 - CVE House
Back to Database
Status published Medium CVE-2005-2254

Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php, or (3) the auction_id parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product, so they are not included in this description.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-2254

Credits & Attribution

No credits recorded in the NVD database.

References

More from gianluca baldo

View All →
CVE-2006-3984
PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction...
High 7.5
CVE-2005-2255
Directory traversal vulnerability in PhpAuction 2.5 allows remote attackers to...
Medium 6.4
CVE-2005-2253
SQL injection vulnerability in PhpAuction 2.5 allow remote attackers to...
High 7.5
CVE-2005-2252
PhpAuction 2.5 allows remote attackers to bypass authentication and gain...
High 7.5
CVE-2002-0995
login.php for PHPAuction allows remote attackers to gain privileges via...
High 7.5

Affected Vendor

gianluca baldo

View all reports →

Affected Software

phpauction
Vulnerable Versions:
2.5

Timeline

Official Publish: July 13th, 2005
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.