{"id":"CVE-2005-1782","aliases":["EUVD-2005-1784","GHSA-2wgw-c7wq-3729"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0513,"percentile":0.9245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2005-05-26T04:00:00Z","modified":"2026-06-16T22:13:40Z","exploits":[{"source":"exploitdb","id":"EDB-25727","title":"BookReview 1.0 - 'add_review.htm' Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25727"},{"source":"exploitdb","id":"EDB-25728","title":"BookReview 1.0 - 'add_contents.htm' Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25728"},{"source":"exploitdb","id":"EDB-25729","title":"BookReview 1.0 - 'suggest_category.htm?node' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25729"},{"source":"exploitdb","id":"EDB-25730","title":"BookReview 1.0 - 'contact.htm?user' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25730"},{"source":"exploitdb","id":"EDB-25731","title":"BookReview 1.0 - 'add_booklist.htm?node' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25731"},{"source":"exploitdb","id":"EDB-25732","title":"BookReview 1.0 - 'add_url.htm?node' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25732"},{"source":"exploitdb","id":"EDB-25733","title":"BookReview 1.0 - 'search.htm?submit string' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25733"},{"source":"exploitdb","id":"EDB-25734","title":"BookReview 1.0 - 'add_classification.htm?isbn' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25734"},{"source":"exploitdb","id":"EDB-25735","title":"BookReview 1.0 - 'suggest_review.htm?node' Cross-Site Scripting","type":"webapps","platform":"php","date":"2005-05-26","verified":true,"url":"https://www.exploit-db.com/exploits/25735"}],"products":[{"vendor":"w.m.r._simpson","product":"bookreview"}],"references":[{"url":"http://www.securityfocus.com/bid/13783","tags":["vdb-entry","x_refsource_BID","x_transferred","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1014058","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16873","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16876","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16874","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16878","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16879","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16871","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16872","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16875","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/16877","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Vendor Advisory"]},{"url":"http://lostmon.blogspot.com/2005/05/bookreview-10-multiple-variable-xss.html","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-1782"},{"url":"https://github.com/advisories/GHSA-2wgw-c7wq-3729"}],"sources":{"cve":[{"id":"CVE-2005-1782","description":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.","status":"published","published":"2005-05-31T04:00:00Z","modified":"2024-08-07T21:59:24.461Z","updated_at":"2026-11-02T14:33:40.245652Z"}],"euvd":[{"id":"EUVD-2005-1784","description":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.","status":"published","published":"2005-05-31T04:00:00Z","modified":"2024-08-07T21:59:24Z","updated_at":"2026-11-03T01:15:33.246394Z"}],"ghsa":[{"id":"GHSA-2wgw-c7wq-3729","title":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.","status":"published","published":"2022-05-01T02:01:53Z","modified":"2023-01-30T05:07:34Z","updated_at":"2026-11-02T14:47:43.103728Z"}],"nvd":[{"id":"CVE-2005-1782","description":"Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.","status":"published","published":"2005-05-26T04:00:00Z","modified":"2026-06-16T22:13:40.717Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:55.600202Z"}]}}