Zikula 1.3.0 build #3168 and probably prior has XSS flaw...
Low severity
Unreviewed
Published
Apr 22, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Nov 19, 2019
Published to the GitHub Advisory Database
Apr 22, 2022
Last updated
Jan 27, 2023
Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context of the affected website.
References