Unscored severity · published Feb 6, 2014
CVE-2013-5983
Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php or (2) cat parameter to mobile/thread.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
Guppy · Guppy
through 4.6.27; 2.4; 2.4_p1; 2.4_p3; 2.4_p4; 4.0; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5983
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2013-10/0111.html
osvdb.org
http://osvdb.org/98841
osvdb.org
http://osvdb.org/98880
packetstormsecurity.com
http://packetstormsecurity.com/files/123747
Vendor Advisory
http://www.freeguppy.org/thread.php?lng=en&pg=244900&cat=200
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/88247
More from Guppy
–
CVE-2007-5845
Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a
–
CVE-2007-5844
Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a
–
CVE-2007-1451
GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" (cleanup.php) and then "Suppression…
–
CVE-2007-0639
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .inc file in the data/ directory…
–
CVE-2006-1224
Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." (mixed encoding) in the pg parameter