CVE-2010-1724

Published: May 6, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.

Affected (1)

Products: Zikula: Zikula Application Framework

1 product

Zikula Application Framework

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zikula Zikula Application Framework	Version 1.2.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (18)

http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement

Source: cve@mitre.org

Vendor Advisory

http://osvdb.org/64096

Source: cve@mitre.org

http://secunia.com/advisories/39614

Source: cve@mitre.org

Vendor Advisory

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html

Source: cve@mitre.org

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html

Source: cve@mitre.org

http://www.osvdb.org/64095

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/510988/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/39717

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/58224

Source: cve@mitre.org

http://community.zikula.org/index.php?module=News&func=display&sid=3012&title=zikula-1.2.3-release-announcement

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://osvdb.org/64096

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/39614

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.htbridge.ch/advisory/xss_vulnerability_in_zikula_application_framework_1.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/64095

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/510988/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/39717

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/58224

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.