CVE:CVE-2007-1606
CNNVD:CNNVD-200703-549
w-Agora (Web-Agora)中存在多个跨站脚本攻击漏洞。远程攻击者可以借助提交到profile.php的(1)showuser参数、到search.php的(2)search_forum或(3)search_user参数或到change_password.php的userid参数，注入任意的web脚本或HTML。
solution:Upgrade w-agora w-agora to a higher version than 4.2.1,and avoid the version 4.2.1