CVE-2013-4759

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-08-09 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) fullname, or (3) email parameter to magnoliaPublic/demo-project/members-area/registration.html.

Affected products

Magnolia-Cms Magnolia Form Module: 1.4, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5 (+3)

References

http://archives.neohapsis.com/archives/bugtraq/2013-07/0160.html
http://osvdb.org/95628
http://packetstormsecurity.com/files/122527/Magnolia-CMS-5.0.1-Community-Edition-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/61423
https://exchange.xforce.ibmcloud.com/vulnerabilities/85940
https://www.htbridge.com/advisory/HTB23163
http://archives.neohapsis.com/archives/bugtraq/2013-07/0160.html
http://osvdb.org/95628
http://packetstormsecurity.com/files/122527/Magnolia-CMS-5.0.1-Community-Edition-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/61423
https://exchange.xforce.ibmcloud.com/vulnerabilities/85940
https://www.htbridge.com/advisory/HTB23163

Get alerted when CVE-2013-4759 or the next vulnerability affects your stack