CVE-2013-4140

Cross-site scripting (XSS) vulnerability in the TinyBox (Simple Splash) module before 7.x-2.2 for Drupal allows remote authenticated users with the "administer tinybox" permission to inject arbitrary web script or HTML via unspecified vectors.

• CWE-79

• http://osvdb.org/95153
• http://seclists.org/fulldisclosure/2013/Jul/86
• http://secunia.com/advisories/54091Vendor Advisory
• http://www.openwall.com/lists/oss-security/2013/07/17/1
• http://www.securityfocus.com/bid/61078
• https://drupal.org/node/2031575Patch
• https://drupal.org/node/2038807Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85600
• http://osvdb.org/95153
• http://seclists.org/fulldisclosure/2013/Jul/86
• http://secunia.com/advisories/54091Vendor Advisory
• http://www.openwall.com/lists/oss-security/2013/07/17/1
• http://www.securityfocus.com/bid/61078
• https://drupal.org/node/2031575Patch
• https://drupal.org/node/2038807Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85600

Published

Jul 29, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4134OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before …
• CVE-2013-4135The vos command in OpenAFS 1.6.x before 1.6.5, when using th…
• CVE-2013-4136ext/common/ServerInstanceDir.h in Phusion Passenger gem befo…
• CVE-2013-4137Multiple SQL injection vulnerabilities in StatusNet 1.0 befo…
• CVE-2013-4138Cross-site scripting (XSS) vulnerability in the Hatch theme …
• CVE-2013-4139The Stage File Proxy module 7.x-1.x before 7.x-1.4 for Drupa…
• CVE-2013-4141Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4142Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4143The (1) checkPasswd and (2) checkGroupXlockPasswds functions…
• CVE-2013-4144There is an object injection vulnerability in swfupload plug…9.8
• CVE-2013-4145Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4146Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…