CVE-2010-3023

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.57%

Published

Aug 16, 2010

Modified

Apr 28, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBDiamondList - '/user/main/update_category?category[description]' Cross-Site Scripting Exploit-DBDiamondList - '/user/main/update_settings?setting[site_title]' Cross-Site Scripting TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) category[description] parameter to user/main/update_category, which is not properly handled by _app/views/categories/index.html.erb; and the (2) setting[site_title] parameter to user/main/update_settings, which is not properly handled by _app/views/settings/_list_settings.rhtml.

Weaknesses (CWE)

CWE-79

Affected Products (1)

hulihanapplications · diamondlistvulnerable

References (20)

http://dev.hulihanapplications.com/issues/show/211

http://dev.hulihanapplications.com/issues/show/213

Exploit

http://packetstormsecurity.org/1008-exploits/diamondlist-xssxsrf.txt

Exploit

http://secunia.com/advisories/40873

Vendor Advisory