Vulnerability record · CVE-2011-2743 · published 19 July 2011

CVE-2011-2743: Chyrp cross-site scripting vulnerability

Chyrp · Chyrp

Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.

4.3 CVSS 2.0 Medium EPSS 2.3% · top 17.2% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

20References, 4 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Chyrp Chyrp

References

Link	Tags
http://osvdb.org/73887
http://osvdb.org/73888
http://osvdb.org/73889
http://secunia.com/advisories/45184	Vendor Advisory
http://securityreason.com/securityalert/8312
http://www.justanotherhacker.com/advisories/JAHx113.txt	Exploit
http://www.ocert.org/advisories/ocert-2011-001.html
http://www.securityfocus.com/archive/1/518890/100/0/threaded
http://www.securityfocus.com/bid/48672	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/68563
http://osvdb.org/73887
http://osvdb.org/73888
http://osvdb.org/73889
http://secunia.com/advisories/45184	Vendor Advisory
http://securityreason.com/securityalert/8312
http://www.justanotherhacker.com/advisories/JAHx113.txt	Exploit
http://www.ocert.org/advisories/ocert-2011-001.html
http://www.securityfocus.com/archive/1/518890/100/0/threaded
http://www.securityfocus.com/bid/48672	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/68563

Track CVE-2011-2743 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2025-69768Chyrp sql injection vulnerabilitySQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php componentEPSS 0.41%16 Mar 2026 6.8CVE-2011-2744Chyrp path traversal vulnerabilityDirectory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded …EPSS 9.0%19 Jul 2011 6.5CVE-2011-2745Chyrp permissions and access controls vulnerabilityupload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploa…EPSS 2.0%27 Jul 2011 6.1CVE-2012-1001Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script…EPSS 3.6%21 Nov 2019 5.3CVE-2024-58285Chyrp cross-site scripting vulnerabilityChyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attack…EPSS 0.26%10 Dec 2025 5.0CVE-2011-2780Chyrp path traversal vulnerabilityDirectory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) …EPSS 13%19 Jul 2011 3.5CVE-2014-7264Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin comp…EPSS 1.4%11 Dec 2014 6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed14 May 2026

Source: NIST National Vulnerability Database (record CVE-2011-2743), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.