CVE:CVE-2007-6126
CNNVD:CNNVD-200711-358
project alumni 1.0.9版本及其早期版本中存在多个跨站脚本攻击漏洞，远程攻击者借助(1) xml/index.php的year参数或(2)view.page.inc.php中的year参数注入任意web脚本或HTML。这也可通过最顶层的Index.php的view操作访问到。
solution:Upgrade project_alumni project_alumni to a higher version than 1.0.9,1.0.8,and avoid the version (,1.0.9],1.0.8