JVN#42927215 a-News from Appleple vulnerable to cross-site scripting

a-News, a web log system from Appleple, contains a cross-site scripting vulnerability.

Note that future releases and maintenance of a-News ended on May 14, 2009. The developer recommends users who wish to continue using a web log system to use a-blog.

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Do not use a-News
As patches will not be provided, the developer recommends to discontinue the use of a-News and switch to a-blog.

Products Affected

• a-News