Cross-site scripting (XSS) vulnerability in BizDesign ImageFolio 3.01 and earlier allows remote attackers to execute arbitrary web script a…

published 2002-12-03 23 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1318

cvss: 6.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.7%; EPSS 4.7% chance of exploitation in 30 days, percentile 91%
public exploits: 2; Exploit-DB

Cross-site scripting (XSS) vulnerability in BizDesign ImageFolio 3.01 and earlier allows remote attackers to execute arbitrary web script as other users via (1) the direct parameter in imageFolio.cgi, or (2) nph-build.cgi.

Timeline

2002-11-27 First public exploit (EDB-22051)
2002-12-03 Published

Exploit prediction

4.69% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-22051 BizDesign ImageFolio 2.x/3.0.1 - 'nph-build.cgi' Cross-Site Scripting webapps, 2002-11-27
EDB-22050 BizDesign ImageFolio 2.x/3.0.1 - 'imageFolio.cgi?direct' Cross-Site Scripting webapps, 2002-11-27

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

References

exchange.xforce.ibmcloud.com /vulnerabilities/10718
vdb-entry
securitytracker.com /id?1005681
vdb-entry
marc.info /?l=bugtraq&m=103842773205148&w=2
mailing-list
securityfocus.com /bid/6265
vdb-entry

Sources

CVE List CVE-2002-1334
NVD CVE-2002-1334

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary