CVE-2010-5027: Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 al...

Security readout for executives and security teams

This is an old cross-site scripting issue in Science Fair In A Box winners.php. If an exposed site runs SFIAB 2.0.6 or 2.2.0, an attacker may be able to make a user’s browser run injected script through the type parameter. Exposure is likely limited to legacy SFIAB deployments, especially internet-facing science fair sites still serving winners.php. The bundle does not identify other affected products or maintained branches. Prioritize if SFIAB is still internet-facing or handles authenticated users. Otherwise, treat as legacy cleanup with moderate urgency because public exploit references exist but active exploitation is not evidenced. Mitigation focus: Inventory public sites for SFIAB 2.0.6 or 2.2.0.; Check SFIAB/vendor guidance for a fixed release or patch.; Restrict access to winners.php until remediation is confirmed..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.