CVE-2013-3728
published 2014-03-13CVE-2013-3728: Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject…
PriorityP417low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
2.95%
85.4th percentile
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kasseler-cms | kasseler-cms | <= 2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kasseler-cms 2 admin.php cat cross site scripting (Patch 122282 / EDB-26623)
vuldb·2026-05-07·CVSS 3.5
CVE-2013-3728 [LOW] Kasseler-cms 2 admin.php cat cross site scripting (Patch 122282 / EDB-26623)
A vulnerability classified as problematic has been found in Kasseler-cms 2. The affected element is an unknown function of the file admin.php. The manipulation of the argument cat leads to cross site scripting.
This vulnerability is documented as CVE-2013-3728. The attack can be initiated remotely. Additionally, an exploit exists.
It is recommended to upgrade the affected component.
GHSA
GHSA-395f-v3mq-5j4j: Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inj
ghsa_unreviewed·2022-05-17
CVE-2013-3728 [LOW] CWE-79 GHSA-395f-v3mq-5j4j: Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inj
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php.
No detection rules found.
No writeups or analysis indexed.
http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94780http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://exchange.xforce.ibmcloud.com/vulnerabilities/85408https://www.htbridge.com/advisory/HTB23158http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94780http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://exchange.xforce.ibmcloud.com/vulnerabilities/85408https://www.htbridge.com/advisory/HTB23158
2014-03-13
Published