CVE-2005-2254

Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php, or (3) the auction_id parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product, so they are not included in this description.

• CWE-79

• http://secunia.com/advisories/15967Vendor Advisory
• http://securitytracker.com/id?1014423Exploit, Vendor Advisory
• http://secunia.com/advisories/15967Vendor Advisory
• http://securitytracker.com/id?1014423Exploit, Vendor Advisory

Published

Jul 13, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-2248Directory traversal vulnerability in DownloadProtect before …
• CVE-2005-2249Multiple unknown vulnerabilities in Jinzora 2.0.1 have unkno…
• CVE-2005-2250Buffer overflow in Bluetooth FTP client (BTFTP) in Nokia Aff…
• CVE-2005-2251PHP remote file inclusion vulnerability in secure.php in PHP…
• CVE-2005-2252PhpAuction 2.5 allows remote attackers to bypass authenticat…
• CVE-2005-2253SQL injection vulnerability in PhpAuction 2.5 allow remote a…
• CVE-2005-2255Directory traversal vulnerability in PhpAuction 2.5 allows r…
• CVE-2005-2256Encoded directory traversal vulnerability in phpPgAdmin 3.1 …
• CVE-2005-2257The saveProfile function in PhpSlash 0.8.0 allows remote att…
• CVE-2005-2258PHP remote file inclusion vulnerability in photolist.inc.php…
• CVE-2005-2259The dispallclosed2 function in dispallclosed.pl for multiple…
• CVE-2005-2260The browser user interface in Firefox before 1.0.5, Mozilla …