CVE-2011-5299

Name of the Vulnerable Software and Affected Versions poMMo Aardvark version PR16.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through several parameters, including the referer parameter to "index.php", the site name parameter to "admin/setup/config/general.php", the group name parameter to "admin/subscribers/subscribers groups.php", or the field name parameter to "admin/setup/setup fields.php".

Recommendations For poMMo Aardvark version PR16.1, consider validating and sanitizing user input for the referer, site name, group name, and field name parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the affected API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.