CVE-2013-3728 Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat param...
LowCVSS 3.5
EPSS 3.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kasseler-cms | <= 2 | No fix listed |
References
- diff.kasseler-cms.net
- diff.kasseler-cms.net patch vendor-advisory
- 94780 vdb-entry
- packetstormsecurity.com
- 20130703 Multiple Vulnerabilities in Kasseler CMS exploit mailing-list
- kasselercms-cve20133728-admin-xss(85408) vdb-entry
- www.htbridge.com exploit