Description
Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context of the affected website.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2009-3415 Vulnerability (CVE-2009-3415)
Jenkins Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2020-2105)
WordPress Plugin Social Essentials-Social Stats and Sharing Buttons Cross-Site Scripting (1.3.1)
MyBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2022-24734)