CVE-2013-20009

MediumCVSS 4.8/10Last modified Nov 3, 2026

Description

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Linksys	WAG200G	<= 1.01.06

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2013

CVE-2013-20016.8Buffer overflow in X.org libXxf86vm 1.1.2 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary c CVE-2013-20026.8Buffer overflow in X.org libXt 1.1.3 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code v CVE-2013-20036.8Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow CVE-2013-20046.8The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion dep CVE-2013-20056.8X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function, which allows X servers to trigger use of a CVE-2013-20062.1OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaint CVE-2013-20076.9The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which CVE-2013-20086.1WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-20098.8WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution CVE-2013-20109.8WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVE-2013-20118.8WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr CVE-2013-20127.3autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.