CVE-2005-3520

Multiple cross-site scripting (XSS) vulnerabilities in MySource 2.14.0 allow remote attackers to...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in MySource 2.14.0 allow remote attackers to inject arbitrary web script or HTML via (1) the target_url parameter in upgrade_in_progress_backend.php, (2) the stylesheet parameter in edit_table_cell_type_wysiwyg.php, and the bgcolor parameter in (3) insert_table.php, (4) edit_table_cell_props.php, (5) header.php, (6) edit_table_row_props.php, and (7) edit_table_props.php.

Exploit likelihood

3.02%Down 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2005-3520
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-3520
Updated: 2026-11-02

EUVDEUVD-2005-3519 No score

Record: EUVD-2005-3519
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vgxh-h5p5-8wqg No score

Multiple cross-site scripting (XSS) vulnerabilities in MySource 2.14.0 allow remote attackers to...

Record: GHSA-vgxh-h5p5-8wqg
Updated: 2026-11-02

Affected products

mysource

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	MySource 2.14 - 'upgrade_in_progress_backend.php?target_url' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'insert_table.php?bgcolor' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'edit_table_cell_props.php?bgcolor' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'header.php?bgcolor' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'edit_table_row_props.php?bgcolor' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'edit_table_props.php?bgcolor' Cross-Site Scripting	2005-10-18
Exploit-DB	MySource 2.14 - 'edit_table_cell_type_wysiwyg.php?Stylesheet' Cross-Site Scripting	2005-10-18

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-3520 is a medium vulnerability (CVSS 4.3) in Mysource, published November 6, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.02%, the 87th percentile. No source names a fixed version.

References

Show 10 moreShow less