vulnwire
4.3med

CVE-2005-31314 exploits

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions,…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.6%
percentile 90%
Public exploits
4
Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to blank.html, or the createdataCX parameter to (2) calendar_d.html, (3) calendar_m.html, or (4) calendar_w.html.

Exploit prediction (EPSS)

3.65% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

Exploits and detections

  • EDB-26311 IceWarp Web Mail 5.5.1 - 'calendar_w.html?createdataCX' Cross-Site Scripting · webapps · 2005-09-30
  • EDB-26310 IceWarp Web Mail 5.5.1 - 'calendar_m.html?createdataCX' Cross-Site Scripting · webapps · 2005-09-30
  • EDB-26309 IceWarp Web Mail 5.5.1 - 'calendar_d.html?createdataCX' Cross-Site Scripting · webapps · 2005-09-30
  • EDB-26308 IceWarp Web Mail 5.5.1 - 'blank.html?id' Cross-Site Scripting · webapps · 2005-09-30

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

References

  • secunia.com /advisories/17046/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/14980 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=112810385104168&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2005/1933 · vdb-entry, x_refsource_VUPEN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.