Description
Multiple remote vulnerabilities exist in vlBook 1.21, including cross-site scripting (XSS) and local file inclusion (LFI). Input parameters are not properly sanitized for HTML output or file operations.
Impact
XSS allows attackers to inject malicious scripts into guestbook entries. LFI allows reading arbitrary files from the server, potentially exposing configuration files and credentials.
Solution
Upgrade to a maintained guestbook application. Apply input validation and output encoding.