CVE-2010-1724 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 4.1% (pctl 90)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 4.1% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-05-06 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| zikula | zikula application framework |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Zikula Application Framework 1.2.2 - 'ZLanguage.php?lang' Cross-Site Scripting | 2010-04-13 |
| exploit-db | Zikula Application Framework 1.2.2 - 'index.php?func' Cross-Site Scripting | 2010-04-13 |
References
- http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement
- http://osvdb.org/64096
- http://secunia.com/advisories/39614
- http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html
- http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html
- http://www.osvdb.org/64095
- http://www.securityfocus.com/archive/1/510988/100/0/threaded
- http://www.securityfocus.com/bid/39717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58224
- http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement
- http://osvdb.org/64096
- http://secunia.com/advisories/39614
- http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html
- http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html
- http://www.osvdb.org/64095
- http://www.securityfocus.com/archive/1/510988/100/0/threaded
- http://www.securityfocus.com/bid/39717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58224
→ the Explorer · watch your stack · NVD