CVE-2013-0181

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-03-27 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.

Affected products

Thomas Seidl Search Api: 7.x-1.0, 7.x-1.0-beta1, 7.x-1.0-beta10, 7.x-1.0-beta2, 7.x-1.0-beta3, 7.x-1.0-beta4 (+10)

References

http://drupalcode.org/project/search_api.git/commitdiff/35b5728
http://osvdb.org/89117
http://secunia.com/advisories/51806
http://www.openwall.com/lists/oss-security/2013/01/15/3
http://www.securityfocus.com/bid/57231
https://drupal.org/node/1884076
https://drupal.org/node/1884332
https://exchange.xforce.ibmcloud.com/vulnerabilities/81153
http://drupalcode.org/project/search_api.git/commitdiff/35b5728
http://osvdb.org/89117
http://secunia.com/advisories/51806
http://www.openwall.com/lists/oss-security/2013/01/15/3

Get alerted when CVE-2013-0181 or the next vulnerability affects your stack