Vulnerabilities

TI-2007-02754 CVE-2007-2847 · GHSA-mjv9-7j58-57cp

Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and…

MEDIUM 44

Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) authusername or (2) authpassword paramet…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.01816 Published 2007-05-24 No fix listed

TI-2007-02722 CVE-2007-2812 · GHSA-gh9c-cfrp-6xww

Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.35, and possibly…

LOW 25

Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the action parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0271 Published 2007-05-22 No fix listed

TI-2007-00817 CVE-2007-0840 · GHSA-4m84-fwpx-mr22

Cross-site scripting (XSS) vulnerability in HLstats before 1.35 allows remote attackers…

LOW 33

Cross-site scripting (XSS) vulnerability in HLstats before 1.35 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the search class.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01251 Published 2007-02-08 No fix listed

TI-2006-06525 CVE-2006-6781 · GHSA-j746-52rw-gq56

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via…

LOW 28

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdata[lastName][] parameters, which reveals the path in an error message.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02928 Published 2006-12-28 No fix listed

TI-2006-06524 CVE-2006-6780 · GHSA-gp4g-hqgp-f63q

SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote…

LOW 35

SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01217 Published 2006-12-28 No fix listed

TI-2006-04389 CVE-2006-4543 · GHSA-96fc-2cqq-824q

Cross-site scripting (XSS) vulnerability in index.php in HLStats 1.34 allows remote…

LOW 34

Cross-site scripting (XSS) vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the (1) game parameter in players mode, the (2) weapon parameter in weaponinfo mode…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01956 Published 2006-09-06 No fix listed

TI-2006-04302 CVE-2006-4454 · GHSA-4gg3-rjc4-pwrr

Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.34 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.34 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01696 Published 2006-08-30 No fix listed