Unscored severity · published Feb 22, 2013
CVE-2013-0730
Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1)…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Newscoop · Sourcefabric
4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0730
Patch
http://forum.sourcefabric.org/discussion/15052/security-patch-released-for-newscoop-4-1
Vendor Advisory
http://secunia.com/advisories/51921
github.com
https://github.com/sourcefabric/Newscoop/commit/4f948ba3afaaeb616006cbabc85906ef3254169d
More from Newscoop
7.8
CVE-2020-11807
Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and sometimes terminal…
–
CVE-2012-4679
Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the f_user_name parameter
–
CVE-2012-1935
Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVE-2012-1934
SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the…
–
CVE-2012-1933
Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_globals is enabled, allow remote attackers to execute arbitrary…