4.3
CVE-2013-5098
- EPSS 1.98%
- Veröffentlicht 09.08.2013 21:55:07
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginDownload Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Mögliche Gegenmaßnahme
Download Monitor: Update to version 3.3.6.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mikejolley ≫ Download Monitor SwPlatformwordpress Version <= 1.0.6
Mikejolley ≫ Download Monitor Version1.0.0 SwPlatformwordpress
Mikejolley ≫ Download Monitor Version1.0.1 SwPlatformwordpress
Mikejolley ≫ Download Monitor Version1.0.2 SwPlatformwordpress
Mikejolley ≫ Download Monitor Version1.0.3 SwPlatformwordpress
Mikejolley ≫ Download Monitor Version1.0.4 SwPlatformwordpress
Mikejolley ≫ Download Monitor Version1.0.5 SwPlatformwordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Download Monitor
Version
[*, 3.3.6.2)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.98% | 0.779 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://plugins.trac.wordpress.org/changeset/723187/download-monitor
http://secunia.com/advisories/53116
http://www.securityfocus.com/bid/61407
https://exchange.xforce.ibmcloud.com/vulnerabilities/85921
https://www.wordfence.com/threat-intel/vulnerabilities/id/1774b9b6-b98b-410c-98eb-326eda53adca