CVE-2002-0166: Stephen Turner Analog

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in analog before 5.22 allows remote attackers to execute Javascript via an HTTP request containing the script, which is entered into a web logfile and not properly filtered by analog during display.

Affected products

• Stephen Turner Analog: version 3.90_beta1 only; version 3.90_beta2 only; version 4.1 only; version 4.01 only; version 4.02 only; version 4.03 only; …

Published 2002-04-22. Last modified 2026-06-16.