Beehive Forum · Beehive Forum · CVE-2015-2198
**Name of the Vulnerable Software and Affected Versions**
Beehive Forum version 1.4.4
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML via the `homepage url`, `pic url`, or `avatar url` parameter in edit prefs.php, which are not properly handled in an error message.
**Recommendations**
For Beehive Forum version 1.4.4, as a temporary workaround, consider restricting access to the edit prefs.php file until a patch is available, and avoid using the `homepage url`, `pic url`, or `avatar url` parameters in this context. At the moment, there is no information about a newer version that contains a fix for this vulnerability.