CVE-2013-3728

LOW 3.5CVE-2013-3728 · Published 13/03/2014 · updated 16/06/2026

In short

CVE-2013-3728 is a LOW (CVSS 3.5) vulnerability affecting kasseler-cms (kasseler-cms).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kasseler-cms kasseler-cms	`≤ 2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.

References

diff.kasseler-cms.net/svn.html
diff.kasseler-cms.net/svn/patches/1232.html · Patch
osvdb.org/94780
packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html
seclists.org/bugtraq/2013/Jul/26 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/85408
htbridge.com/advisory/HTB23158 · Exploit

More vulnerabilities in kasseler-cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free