CVE-2013-5913

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the getRecommSearch function in recommlist.php in OXID eShop before 4.6.7, Professional and Community Edition 4.7.x before 4.7.8, and Enterprise Edition 5.x before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via the searchrecomm parameter.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/98235Broken Link
http://secunia.com/advisories/55193Vendor Advisory
http://wiki.oxidforge.org/Security_bulletins/2013-001Vendor Advisory
http://www.securityfocus.com/bid/62901Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87760VDB Entry
http://osvdb.org/98235Broken Link
http://secunia.com/advisories/55193Vendor Advisory
http://wiki.oxidforge.org/Security_bulletins/2013-001Vendor Advisory
http://www.securityfocus.com/bid/62901Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87760VDB Entry

Timeline

Published: Oct 15, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-59146.8Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to e CVE-2013-59154.3The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers CVE-2013-59164.3Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco Gateway plugin 2.0 for Wordpress, as used in the WP e-Commerce plugin,CVE-2013-59177.5SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary CVE-2013-59184.3Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attack CVE-2013-59195.0Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.CVE-2013-59304.3Cross-site scripting (XSS) vulnerability in search_residential.php in Real Estate PHP Script allows remote attackers to inject arbitrary web CVE-2013-59317.5SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL comma CVE-2013-593210.0Unspecified vulnerability in WebAdmin in Sophos UTM (aka Astaro Security Gateway) before 9.105 has unknown impact and attack vectors.CVE-2013-59336.9Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for R CVE-2013-59344.0Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 has a hardcoded password for node join operations, which allows CVE-2013-59354.3The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set