CVEvulnerability

CVE-2013-6808

4.3 MEDIUM Published 2013-12-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2013-12-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.

Affected configurations

• zend zendto (<= 4.11-12) • zend zendto 4.00 • zend zendto 4.01 • zend zendto 4.02 • zend zendto 4.03-3 • zend zendto 4.05-2 • zend zendto 4.06-2 • zend zendto 4.07-1 • zend zendto 4.08-4 • zend zendto 4.09-1 • zend zendto 4.10-4 • zend zendto 4.10-5 • zend zendto 4.11-1 • zend zendto 4.11-2 • zend zendto 4.11-3 • zend zendto 4.11-4 • zend zendto 4.11-5 • zend zendto 4.11-7 • zend zendto 4.11-8 • zend zendto 4.11-9 • zend zendto 4.11-10 • zend zendto 4.11-11

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References