CVE-2013-20006 Qool CMS Multiple Persistent Cross-Site Scripting Vulnerabilities
Attackers can inject malicious scripts via unsanitized POST parameters in Qool CMS admin panels, potentially compromising administrator sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-20006?
CVE-2013-20006 is a high-severity cross-site scripting vulnerability in Qool CMS, published on 15 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.
Weakness: CWE-79
Which versions are affected by CVE-2013-20006?
How do I fix CVE-2013-20006?
No fix has been published for CVE-2013-20006 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-20006 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-20006 exists.
Sources
Also known as GHSA-v9gc-c4r9-gw5c.