PowerEasy SiteWeaver ComeUrl Cross-Site Scripting &

From sentiment Blog

PowerEasy cross-site Vulnerability

It is easy to use SiteWeaver, which can be used by malicious people for cross-site scripting attacks.

Input passed to "ComeUrl" does not properly process returned parameters to the User/User_ChkLogin.asp. This can be used to execute arbitrary HTML and script code in the user's affected browser sessions.

This security vulnerability is reported in version 6.8. Other versions may also be affected.

Security suggestions:

Filter User/User_ChkLogin.asp and "ComeUrl"

Refer to official patches
Http://www.powereasy.net/