Description

Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php.

Remediation

References

CVE-2011-3979

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-4662)

WordPress Plugin Royal Elementor Addons and Templates Arbitrary File Upload (1.3.78)

Joomla CVE-2021-23132 Vulnerability (CVE-2021-23132)

WordPress Plugin WordPress-Amazon-Associate (WPAA) Multiple Cross-Site Scripting Vulnerabilities (1.7.3)

WordPress Plugin Contact Form by WD-responsive drag & drop contact form builder tool Multiple Vulnerabilities (1.12.20)

Severity

Medium

Classification

CVE-2011-3979 CWE-707

Tags

Missing Update Known Vulnerabilities