Zikula

12 CVEs across 2 Zikula products. Browse Zikula vulnerabilities, severities, and proof-of-concept exploits.

Zikula products with known CVEs

ProductCVEs
Zikula Application Framework10
Zikula2
Zikula CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2011-3352Medium4.82019-11-19Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting t…
CVE-2014-2293Critical9.82018-03-26Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitr…
CVE-2016-9835Critical9.82016-12-05Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP o…
CVE-2013-61682013-11-14Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the re…
CVE-2011-39792011-10-04Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 bu…
CVE-2011-38262011-09-24Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error messa…
CVE-2011-09112011-02-08Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecif…
CVE-2011-05352011-02-08Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrato…
CVE-2010-47292011-02-08Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote…
CVE-2010-47282011-02-08Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechani…
CVE-2010-17242010-05-06Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web…
CVE-2010-17322010-05-06Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authenti…