Description

Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php.

Remediation

References

CVE-2011-3979

Related Vulnerabilities

WordPress Plugin Donation Forms by Charitable-Donations & Fundraising Platform for WordPress Security Bypass (1.5.13)

Magento Insufficient Session Expiration Vulnerability (CVE-2019-8149)

PleskLin URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-24044)

WordPress Plugin MC4WP:Mailchimp for WordPress Cross-Site Scripting (4.1.6)

WordPress Plugin Child Theme Configurator Arbitrary File Disclosure (1.7.4)

Severity

Medium

Classification

CVE-2011-3979 CWE-707

Tags

Missing Update Known Vulnerabilities