Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2005-4196: Scout Portal Toolkit lets attackers run malicious scripts

CVE-2005-4196 · published 20 years ago

Summary

The Scout Portal Toolkit (versions 1.3.1 and earlier) can be tricked into accepting malicious code through many of its web pages. An attacker could insert harmful script or HTML, potentially stealing data or hijacking user sessions. Update to a newer version or apply the vendor’s patches to block these inputs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
internet_scout	scout_portal_toolkit	<= 1.3.1 1.3.0_beta `cpe:2.3:a:internet_scout:scout_portal_toolkit::::::::`

Original advisory text

Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the ss parameter in SPT--QuickSearch.php; (2) ParentId parameter in SPT--BrowseResources.php; (3) the ResourceId parameter in SPT--FullRecord.php; (4) ResourceOffset parameter in SPT--Home.php, (5) F_SearchString parameter in SPT--QuickSearch.php; (6) F_UserName and (7) F_Password parameters in SPT--UserLogin.php; (8) F_SearchCat1, (9) F_TextField1, (10) F_SearchCat2, (11) F_TextField2, (12) F_SearchCat3, (13) F_TextField3, (14) F_SearchCat4, (15) F_TextField4, (16) ResourceType, (17) Language, (18) Audience, (19) Format parameters in SPT--AdvancedSearch.php.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

5% chance of attack within 30 days

Timeline

Published13 Dec 2005

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2005-4196 · NVD

Track software like this

Free during beta