CVE-2013-4556

SPIP <3.0.12, <2.1.24 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.

References (8)

[Patch] http://core.spip.org/projects/spip/repository/revisions/20879

[Various Sources] http://core.spip.org/projects/spip/repository/revisions/20880

[Vendor Advisory] http://secunia.com/advisories/55551

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1029317

[Various Sources] http://www.spip.net/fr_article5646.html

[Various Sources] http://www.spip.net/fr_article5648.html

[Third Party Advisory] https://www.debian.org/security/2013/dsa-2794

[Mailing List] http://www.openwall.com/lists/oss-security/2013/11/10/4

Scores

EPSS 0.0033

EPSS Percentile 55.6%

Details

CWE

CWE-79

Status published

Products (50)

spip/spip < 2.1.23

spip/spip

... and 40 more

Published Nov 18, 2013

Tracked Since Feb 18, 2026