Description
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
Exploits (1)
References (7)
Core 7
Core References
Product x_refsource_misc
http://wordpress.org/plugins/pretty-link/changelog
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/121623/Joomla-Jnews-8.0.1-Cross-Site-Scripting.html
Patch, Vendor Advisory x_refsource_confirm
https://civicrm.org/advisory/civi-sa-2013-002-openflashchart-xss
Exploit, Patch mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-02/0101.html
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/120433/WordPress-Pretty-Link-1.6.3-Cross-Site-Scripting.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/90435
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/82242
Scores
EPSS
0.1032
EPSS Percentile
93.3%
Details
CWE
CWE-79
Status
published
Products (45)
caseproof/prettylinks
1.6.0
caseproof/prettylinks
1.6.1
caseproof/prettylinks
< 1.6.2
civicrm/civicrm
3.1.0
civicrm/civicrm
3.1.1
civicrm/civicrm
3.1.2
civicrm/civicrm
3.1.3
civicrm/civicrm
3.1.4
civicrm/civicrm
3.1.5
civicrm/civicrm
3.1.6
... and 35 more
Published
Mar 12, 2014
Tracked Since
Feb 18, 2026