CVE-2013-2294

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-30 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the Shortlog table in templates/shortlog.php or branch name to the (2) Shortlog table in templates/shortlog.php or (3) Heads table in plates/summary.php.

Affected products

Viewgit Project Viewgit: before 0.0.7 — fixed in 0.0.7

How to fix

Upgrade to a fixed version: Viewgit Project Viewgit 0.0.7. Check the vendor advisory for mitigations.

References

http://freecode.com/projects/viewgit/releases/353086
http://packetstormsecurity.com/files/120862/ViewGit-0.0.6-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2013/Mar/174
http://www.exploit-db.com/exploits/24862
http://freecode.com/projects/viewgit/releases/353086
http://packetstormsecurity.com/files/120862/ViewGit-0.0.6-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2013/Mar/174
http://www.exploit-db.com/exploits/24862

Get alerted when CVE-2013-2294 or the next vulnerability affects your stack