This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting to think that this is not a code related issue. Can someone please give me any idea on how to resolve this, please?

DCP-Portal Cross Site Scripting Bugs

There are multiple cross-site scripting vulnerabilities in the version of DCP-Portal (5.3.2 and earlier) running on this host. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters in calendar.php, index.php, annoucement.php, news.php, contents.php, search.php, and register.php. All Cross-Site Scripting vulnerabilities are considered non-compliant by PCI.

  • 3
    Are you running DCP Portal 5.3.2 or earlier? The automated scanner detected that version of the software, which is vulnerable to CVE-2004-2511. If you aren't running DCP Portal, then it's probably a false positive. Commented Mar 9, 2022 at 14:39

1 Answer 1


I would check the evidence and proof of concept code they provide and manually confirm if your setup is actually vulnerable as they report.

If you can demonstrate that the vulnerability can't be exploited as there evidence suggests, then file a dispute request against the finding. They will investigate it manually, and if it's really not vulnerable, they will remove the finding.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .