Description
In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.
Remediation
References
Related Vulnerabilities
WordPress Plugin Shortcode Redirect 'domain' Parameter Cross-Site Scripting (1.0.01)
MySQL CVE-2012-1734 Vulnerability (CVE-2012-1734)
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-7002)
WordPress Plugin Gravity Forms Dynamics CRM Cross-Site Scripting (1.0.7)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-9481)