CVE-2013-6163

Projeqtor < 3.4.4 - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to view/parameter.php, (2) p1value parameter to view/main.php, or (3) objectClass parameter to view/objectDetail.php.

References (10)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2013-11/0021.html

[Third Party Advisory] http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0032.html

[Third Party Advisory, VDB Entry] http://osvdb.org/99366

[Third Party Advisory, VDB Entry] http://osvdb.org/99368

[Third Party Advisory, VDB Entry] http://osvdb.org/99369

[Exploit] http://packetstormsecurity.com/files/123916

[Various Sources] http://projectorria.org/index.php/menu_download_en/menu_history_en

[Vendor Advisory] http://secunia.com/advisories/55451

[Exploit] http://www.securityfocus.com/bid/63539

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/88583

Scores

EPSS 0.0066

EPSS Percentile 71.0%

Details

CWE

CWE-79

Status published

Products (50)

projeqtor/projeqtor < 3.4.4

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

projeqtor/projeqtor

... and 40 more

Published Nov 14, 2013

Tracked Since Feb 18, 2026