XSS in Qool Cms
CVE-2013-20006
Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (26.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Qool Cms — versions 2.0
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/24627 (exploit)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5133.php (vendor-advisory)
- www.vulncheck.com/advisories/qool-cms-multiple-persistent-cross-site-scripting-… (third-party-advisory)
Frequently asked questions
- What is CVE-2013-20006?
- CVE-2013-20006 is a high-severity vulnerability in Qool Cms, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2026-03-16.
- How severe is CVE-2013-20006?
- High severity. CVSS v3 base score is 7.5 out of 10.