XSS in Qool Cms
CVE-2013-20006
Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (28.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Qool Cms — versions 2.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2013-20006?
- CVE-2013-20006 is a high-severity vulnerability in Qool Cms, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2026-03-16.
- How severe is CVE-2013-20006?
- High severity. CVSS v3 base score is 7.5 out of 10.