VYPR
← All advisories
Unrated severityNVD Advisory· Published May 24, 2005· Updated Jun 16, 2026

CVE-2005-1715

CVE-2005-1715

Description

Cross-site scripting (XSS) vulnerability in index.php for TOPo 2.2 (2.2.178) allows remote attackers to inject arbitrary web script or HTML via the (1) m, (2) s, (3) ID, or (4) t parameters, or the (5) field name, (6) Your Web field, or (7) email field in the comments section.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1
  • TOPo/TOPollm-fuzzy
    Range: = 2.2 (2.2.178)

Patches

Vulnerability mechanics

Root cause

"Missing input validation in `index.php` allows arbitrary script injection via multiple parameters and comment form fields."

Attack vector

An attacker crafts a URL containing malicious JavaScript in one of the vulnerable parameters (`m`, `s`, `ID`, `t`) and tricks a victim into clicking it. When the victim's browser loads the URL, the injected script executes in the context of the TOPo site, allowing the attacker to steal cookies, deface the page, or perform other actions. The same injection is possible through the comment form fields (name, website, email) when submitting a comment [ref_id=1].

Affected code

The vulnerability resides in `index.php` of TOPo 2.2 (version 2.2.178). The `m`, `s`, `ID`, and `t` parameters are not validated before being reflected in the page output. Additionally, the "field name", "Your Web field", and "email field" in the comments section are also unvalidated [ref_id=1].

What the fix does

No patch or fix was available at the time of disclosure [ref_id=1]. The advisory recommends that the application properly validate and sanitize all user-supplied input before reflecting it in output. Without a fix, the only mitigation is to manually filter or escape the `m`, `s`, `ID`, `t`, and comment form fields in `index.php`.

Preconditions

  • inputThe attacker must trick a victim into clicking a crafted URL or submitting a malicious comment form.
  • configThe victim's browser must have JavaScript enabled.

Reproduction

1. Host a JavaScript payload (e.g., `js.js`) on an attacker-controlled server. 2. Craft a URL such as `http://[victim]/topo/index.php?m=top">

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.