CVE-2013-7277

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to saa.php, (2) username parameter to login.php, or (3) keyword_list parameter to keysearch.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.htmlPatch, Vendor Advisory
http://osvdb.org/101467Patch
http://osvdb.org/101491
http://osvdb.org/101492
http://secunia.com/advisories/56228Vendor Advisory
http://sourceforge.net/p/aphpkb/code/91Exploit, Patch
http://www.securityfocus.com/bid/64550
https://www.netsparker.com/critical-xss-vulnerabilities-andy-php-knowledgebase
http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.htmlPatch, Vendor Advisory
http://osvdb.org/101467Patch
http://osvdb.org/101491
http://osvdb.org/101492
http://secunia.com/advisories/56228Vendor Advisory
http://sourceforge.net/p/aphpkb/code/91Exploit, Patch
http://www.securityfocus.com/bid/64550
https://www.netsparker.com/critical-xss-vulnerabilities-andy-php-knowledgebase

Timeline

Published: Jan 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-72787.5SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to de CVE-2013-72794.3Cross-site scripting (XSS) vulnerability in views/video-management/preview_video.php in the S3 Video plugin before 0.983 for WordPress allow CVE-2013-72804.3Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of service (crash) via a long CVE-2013-72814.9The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that CVE-2013-728210.0The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36_NIS01 CVE-2013-72839.3Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact a CVE-2013-72846.8The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code vi CVE-2013-72859.8Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run CVE-2013-72867.5MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm CVE-2013-72879.8MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.CVE-2013-72884.3Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6 CVE-2013-72894.3Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attacker