CVE-2013-7429

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2013/Jul/158Exploit, Mailing List, Third Party Advisory
http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.htmlPatch, URL Repurposed
http://www.openwall.com/lists/oss-security/2015/02/26/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/02/26/4Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2013/Jul/158Exploit, Mailing List, Third Party Advisory
http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.htmlPatch, URL Repurposed
http://www.openwall.com/lists/oss-security/2015/02/26/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/02/26/4Mailing List, Third Party Advisory

Timeline

Published: Sep 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-74306.1Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web scr CVE-2013-74315.3Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-74327.5The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.CVE-2013-74336.1Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.CVE-2013-74356.5The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitiv CVE-2013-74364.3noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this c CVE-2013-74375.0Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, CVE-2013-74387.5Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a CVE-2013-74397.5Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow CVE-2013-74405.9The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, w CVE-2013-74417.8The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (r CVE-2013-744210.0GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of (1) CANal1 for the Administrator user and (2) iis for the IIS user