{"api_version":"1","generated_at":"2026-07-23T10:45:32+00:00","cve":"CVE-2010-4749","urls":{"html":"https://cve.report/CVE-2010-4749","api":"https://cve.report/api/cve/CVE-2010-4749.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-4749","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-4749"},"summary":{"title":"CVE-2010-4749","description":"Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-03-01 22:00:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt","name":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BLOG:CMS 4.2.1e Cross Site Request Forgery / Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html","name":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"High-Tech Bridge SA - Advisories - XSS vulnerability in BLOG:CMS","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/8112","name":"http://securityreason.com/securityalert/8112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BLOG:CMS 4.2.1e Cross Site Request Forgery / Cross Site Scripting - SecurityReason.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/15743","name":"http://www.exploit-db.com/exploits/15743","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BLOG:CMS <= v4.2.1e Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html","name":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"High-Tech Bridge SA - Advisories - cross site scripting vulnerability in BLOG:CMS","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html","name":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"High-Tech Bridge SA - Advisories - Stored XSS vulnerability in BLOG:CMS","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://blogcms.com/","name":"http://blogcms.com/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"The Most Advanced Personal Content Management System","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4749","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4749","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"4749","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"blogcms","cpe5":"blog\\","cpe6":"cms","cpe7":"4.2.1.e","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T03:55:35.023Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html"},{"name":"15743","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/15743"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blogcms.com/"},{"name":"8112","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/8112"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-12-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2011-09-22T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html"},{"name":"15743","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/15743"},{"tags":["x_refsource_MISC"],"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html"},{"tags":["x_refsource_MISC"],"url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://blogcms.com/"},{"name":"8112","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/8112"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2010-4749","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html","refsource":"MISC","url":"http://www.htbridge.ch/advisory/cross_site_scripting_vulnerability_in_blogcms.html"},{"name":"15743","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/15743"},{"name":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html","refsource":"MISC","url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms_1.html"},{"name":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html","refsource":"MISC","url":"http://www.htbridge.ch/advisory/xss_vulnerability_in_blogcms.html"},{"name":"http://blogcms.com/","refsource":"CONFIRM","url":"http://blogcms.com/"},{"name":"8112","refsource":"SREASON","url":"http://securityreason.com/securityalert/8112"},{"name":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt","refsource":"MISC","url":"http://packetstormsecurity.org/files/view/96731/blogcms-xsrfxss.txt"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2010-4749","datePublished":"2011-03-01T21:00:00.000Z","dateReserved":"2011-03-01T00:00:00.000Z","dateUpdated":"2024-08-07T03:55:35.023Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-03-01 22:00:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:blogcms:blog\\:cms:4.2.1.e:*:*:*:*:*:*:*","matchCriteriaId":"ED3D8F7B-76EF-400B-AF35-EBE25F6022E7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"4749","Ordinal":"1","Title":"CVE-2010-4749","CVE":"CVE-2010-4749","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"4749","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) body parameter to action.php and the (2) amount and (3) action parameters to admin/index.php.","Type":"Description","Title":"CVE-2010-4749"},{"CveYear":"2010","CveId":"4749","Ordinal":"2","NoteData":"2011-03-01","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"4749","Ordinal":"3","NoteData":"2011-09-22","Type":"Other","Title":"Modified"}]}}}