CVE-2013-0201

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.

• CWE-79

• http://osvdb.org/89505Broken Link
• http://osvdb.org/89506Broken Link
• http://osvdb.org/89511Broken Link
• http://owncloud.org/about/security/advisories/oC-SA-2013-001Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81475
• https://github.com/owncloud/core/commit/4e2b834Exploit, Patch
• https://github.com/owncloud/core/commit/b8e0309Exploit, Patch
• http://osvdb.org/89505Broken Link
• http://osvdb.org/89506Broken Link
• http://osvdb.org/89511Broken Link
• http://owncloud.org/about/security/advisories/oC-SA-2013-001Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81475
• https://github.com/owncloud/core/commit/4e2b834Exploit, Patch
• https://github.com/owncloud/core/commit/b8e0309Exploit, Patch

Published

Mar 18, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0195Cross-site Scripting (XSS) in Piwik before 1.10.1 allows rem…6.1
• CVE-2013-0196A CSRF issue was found in OpenShift Enterprise 1.2. The web …6.5
• CVE-2013-0197Cross-site scripting (XSS) vulnerability in the filter_draw_…
• CVE-2013-0198Dnsmasq before 2.66test2, when used with certain libvirt con…
• CVE-2013-0199The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not res…
• CVE-2013-0200HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows …
• CVE-2013-0202Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, …6.1
• CVE-2013-0203Multiple cross-site scripting (XSS) vulnerabilities in ownCl…5.4
• CVE-2013-0204settings/personal.php in ownCloud 4.5.x before 4.5.6 allows …
• CVE-2013-0205Cross-site request forgery (CSRF) vulnerability in the RESTf…
• CVE-2013-0206Unrestricted file upload vulnerability in the Live CSS modul…
• CVE-2013-0207Cross-site request forgery (CSRF) vulnerability in the Mark …