CVE-2005-3511

Multiple cross-site scripting (XSS) vulnerabilities in Spymac Web OS 4.0 allow remote attackers to inject arbitrary web script or HTML via (a) the blogs module, including the (1) curr parameter in index.php, (2) inspire, (3) system, or (4) title parameter in blog_newentry.php, (5) entry parameter in blog_newentry_comment.php, (6) entry parameter in blog_edit_entry.php, or (7) caldate parameter in blog.php; and (b) the notes module, including the (1) forwardid parameter in a noteform action; (2) del_folder parameter in a delete_folder action; (3) isread, (4) dateorder, (5) subjectorder, (6) curr, (7) fromorder, or (8) action parameters; (9) ppp or (10) totalreplies parameter in an Inbox action; (11) totalnotes parameter; or (12) touserid parameter in a noteform action.

• CWE-79

• http://lostmon.blogspot.com/2005/11/spymac-web-os-v4-blogs-and-notes.htmlExploit, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2312Vendor Advisory
• http://lostmon.blogspot.com/2005/11/spymac-web-os-v4-blogs-and-notes.htmlExploit, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2312Vendor Advisory

Published

Nov 6, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3505Cross-site scripting (XSS) vulnerability in the Entropy Chat…
• CVE-2005-3506Cross-site scripting (XSS) vulnerability in proxy.asp in Sam…
• CVE-2005-3507Directory traversal vulnerability in CuteNews 1.4.1 allows r…
• CVE-2005-3508SQL injection vulnerability in showGallery.php in Gallery (G…
• CVE-2005-3509Multiple SQL injection vulnerabilities in JPortal allow remo…
• CVE-2005-3510Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cau…
• CVE-2005-3512Cross-site scripting (XSS) vulnerability in index.php in VUB…
• CVE-2005-3513index.php in VUBB alpha rc1 allows remote attackers to obtai…
• CVE-2005-3514Multiple cross-site scripting (XSS) vulnerabilities in Chipm…
• CVE-2005-3515Cross-site scripting (XSS) vulnerability in recommend.php in…
• CVE-2005-3516Cross-site scripting (XSS) vulnerability in recommend.php in…
• CVE-2005-3517Chipmunk Scripts Guestbook allows remote attackers to obtain…