CVE-2010-1905 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 2.5% (pctl 84)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to sdccommon/verify/asp/n6plugindestructor.asp.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 2.48% — more likely to be exploited than 84% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-05-12 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| consona | consona dynamic agent |
| consona | consona live assistance |
| consona | consona subscriber assistance |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Consona - 'n6plugindestructor.asp' Cross-Site Scripting | 2010-05-07 |
References
- http://secunia.com/advisories/39740
- http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
- http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
- http://www.kb.cert.org/vuls/id/602801
- http://www.securityfocus.com/archive/1/511176/100/0/threaded
- http://www.securityfocus.com/bid/39999
- http://www.wintercore.com/downloads/rootedcon_0day.pdf
- http://secunia.com/advisories/39740
- http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
- http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
- http://www.kb.cert.org/vuls/id/602801
- http://www.securityfocus.com/archive/1/511176/100/0/threaded
- http://www.securityfocus.com/bid/39999
- http://www.wintercore.com/downloads/rootedcon_0day.pdf
→ the Explorer · watch your stack · NVD