Unscored severity · published Nov 19, 2013
CVE-2013-6042
Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo before 2.1.4 allows remote attackers to inject arbitrary web…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo before 2.1.4 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webuzo · Softaculous
through 2.1.3; 1.0; 1.1; 1.2; 1.3; 1.4; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6042
osvdb.org
http://osvdb.org/99203
www.baesystemsdetica.com.au
http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29
www.securityfocus.com
http://www.securityfocus.com/bid/63464
www.softaculous.com
http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched
More from Webuzo
9.8
CVE-2024-24621
Softaculous Webuzo Authentication Bypass
8.8
CVE-2024-24622
Softaculous Webuzo Password Reset Command Injection
8.8
CVE-2024-24623
Softaculous Webuzo FTP Management Command Injection
–
CVE-2013-6043
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which…
–
CVE-2013-6041
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action