{"api_version":"1","generated_at":"2026-07-23T08:55:45+00:00","cve":"CVE-2010-3931","urls":{"html":"https://cve.report/CVE-2010-3931","api":"https://cve.report/api/cve/CVE-2010-3931.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-3931","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-3931"},"summary":{"title":"CVE-2010-3931","description":"Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.","state":"PUBLISHED","assigner":"jpcert","published_at":"2011-01-20 19:00:05","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64745","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64745","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://jvn.jp/en/jp/JVN09115481/index.html","name":"http://jvn.jp/en/jp/JVN09115481/index.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"JVN#09115481: Cross-site scripting vulnerability in multiple Rocomotion products","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/45838","name":"http://www.securityfocus.com/bid/45838","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Multiple Rocomotion products Unspecified Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/42957","name":"http://secunia.com/advisories/42957","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Rocomotion Products Script Insertion Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html","name":"http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/70495","name":"http://osvdb.org/70495","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://another.rocomotion.jp/12949466953653.html","name":"http://another.rocomotion.jp/12949466953653.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"P boardなど当サイトのPHPスクリプトをお使いの方へ | Another Rocomotion","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3931","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3931","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.07","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"pm_bbs","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.18","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"pm_forum","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"3.31","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"pplog","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"3.37","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"pplog_2","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.18","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_board","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.13","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_diary_r","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.30","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_forum","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.11","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_link","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.04","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_link_compact","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"3931","vulnerable":"1","versionEndIncluding":"1.38","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rocomotion","cpe5":"p_up_board","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T03:26:12.154Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"JVN#09115481","tags":["third-party-advisory","x_refsource_JVN","x_transferred"],"url":"http://jvn.jp/en/jp/JVN09115481/index.html"},{"name":"42957","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/42957"},{"name":"JVNDB-2011-000006","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred"],"url":"http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html"},{"name":"45838","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/45838"},{"name":"rocomotion-unspecified-xss(64745)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64745"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://another.rocomotion.jp/12949466953653.html"},{"name":"70495","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/70495"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-01-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","shortName":"jpcert"},"references":[{"name":"JVN#09115481","tags":["third-party-advisory","x_refsource_JVN"],"url":"http://jvn.jp/en/jp/JVN09115481/index.html"},{"name":"42957","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/42957"},{"name":"JVNDB-2011-000006","tags":["third-party-advisory","x_refsource_JVNDB"],"url":"http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html"},{"name":"45838","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/45838"},{"name":"rocomotion-unspecified-xss(64745)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64745"},{"tags":["x_refsource_CONFIRM"],"url":"http://another.rocomotion.jp/12949466953653.html"},{"name":"70495","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/70495"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"vultures@jpcert.or.jp","ID":"CVE-2010-3931","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"JVN#09115481","refsource":"JVN","url":"http://jvn.jp/en/jp/JVN09115481/index.html"},{"name":"42957","refsource":"SECUNIA","url":"http://secunia.com/advisories/42957"},{"name":"JVNDB-2011-000006","refsource":"JVNDB","url":"http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html"},{"name":"45838","refsource":"BID","url":"http://www.securityfocus.com/bid/45838"},{"name":"rocomotion-unspecified-xss(64745)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/64745"},{"name":"http://another.rocomotion.jp/12949466953653.html","refsource":"CONFIRM","url":"http://another.rocomotion.jp/12949466953653.html"},{"name":"70495","refsource":"OSVDB","url":"http://osvdb.org/70495"}]}}}},"cveMetadata":{"assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","assignerShortName":"jpcert","cveId":"CVE-2010-3931","datePublished":"2011-01-20T18:00:00.000Z","dateReserved":"2010-10-12T00:00:00.000Z","dateUpdated":"2024-08-07T03:26:12.154Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-01-20 19:00:05","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_board:*:*:*:*:*:*:*:*","versionEndIncluding":"1.18","matchCriteriaId":"ABE2F7F7-76E9-4D08-BE48-AF1A6088B674"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_diary_r:*:*:*:*:*:*:*:*","versionEndIncluding":"1.13","matchCriteriaId":"30E67FE9-3D35-4628-B9B1-EB24E3D38EC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_forum:*:*:*:*:*:*:*:*","versionEndIncluding":"1.30","matchCriteriaId":"21419B2D-347B-4D5F-A9DB-5C1594CBEC76"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_link:*:*:*:*:*:*:*:*","versionEndIncluding":"1.11","matchCriteriaId":"442294CF-AA14-44A6-A118-64BC30E60918"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_link_compact:*:*:*:*:*:*:*:*","versionEndIncluding":"1.04","matchCriteriaId":"6ED4701F-D5BD-44CD-9E41-2E09DCB9D3CA"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:p_up_board:*:*:*:*:*:*:*:*","versionEndIncluding":"1.38","matchCriteriaId":"8E2B5EAC-1FAE-49B7-BABA-639F92337BDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:pm_bbs:*:*:*:*:*:*:*:*","versionEndIncluding":"1.07","matchCriteriaId":"26026B95-CE50-4C7E-AF28-5D0C8FFBD8E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:pm_forum:*:*:*:*:*:*:*:*","versionEndIncluding":"1.18","matchCriteriaId":"48F989A3-5F6B-405E-8565-01D19733FC78"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:pplog:*:*:*:*:*:*:*:*","versionEndIncluding":"3.31","matchCriteriaId":"3ECF2833-40BF-4D96-8C39-CAD06B261359"},{"vulnerable":true,"criteria":"cpe:2.3:a:rocomotion:pplog_2:*:*:*:*:*:*:*:*","versionEndIncluding":"3.37","matchCriteriaId":"A83A5C5A-B35A-4770-B613-A2DCEC380C1F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"3931","Ordinal":"1","Title":"CVE-2010-3931","CVE":"CVE-2010-3931","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"3931","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.","Type":"Description","Title":"CVE-2010-3931"},{"CveYear":"2010","CveId":"3931","Ordinal":"2","NoteData":"2011-01-20","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"3931","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}