Zikula
12 CVEs across 2 Zikula products. Browse Zikula vulnerabilities, severities, and proof-of-concept exploits.
Zikula products with known CVEs
Zikula CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2011-3352 | Medium | 4.8 | 2019-11-19 | Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting t… |
CVE-2014-2293 | Critical | 9.8 | 2018-03-26 | Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitr… |
CVE-2016-9835 | Critical | 9.8 | 2016-12-05 | Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP o… |
CVE-2013-6168 | | | 2013-11-14 | Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the re… |
CVE-2011-3979 | | | 2011-10-04 | Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 bu… |
CVE-2011-3826 | | | 2011-09-24 | Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error messa… |
CVE-2011-0911 | | | 2011-02-08 | Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecif… |
CVE-2011-0535 | | | 2011-02-08 | Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrato… |
CVE-2010-4729 | | | 2011-02-08 | Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote… |
CVE-2010-4728 | | | 2011-02-08 | Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechani… |
CVE-2010-1724 | | | 2010-05-06 | Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web… |
CVE-2010-1732 | | | 2010-05-06 | Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authenti… |