CVE-2013-7277

Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to saa.php, (2) username parameter to login.php, or (3) keyword_list parameter to keysearch.php.

• CWE-79

• http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.htmlPatch, Vendor Advisory
• http://osvdb.org/101467Patch
• http://osvdb.org/101491
• http://osvdb.org/101492
• http://secunia.com/advisories/56228Vendor Advisory
• http://sourceforge.net/p/aphpkb/code/91Exploit, Patch
• http://www.securityfocus.com/bid/64550
• https://www.netsparker.com/critical-xss-vulnerabilities-andy-php-knowledgebase
• http://aphpkb.blogspot.dk/2013/12/release-of-aphpkb-0958.htmlPatch, Vendor Advisory
• http://osvdb.org/101467Patch
• http://osvdb.org/101491
• http://osvdb.org/101492
• http://secunia.com/advisories/56228Vendor Advisory
• http://sourceforge.net/p/aphpkb/code/91Exploit, Patch
• http://www.securityfocus.com/bid/64550
• https://www.netsparker.com/critical-xss-vulnerabilities-andy-php-knowledgebase

Published

Jan 8, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-7270The packet_recvmsg function in net/packet/af_packet.c in the…
• CVE-2013-7271The x25_recvmsg function in net/x25/af_x25.c in the Linux ke…
• CVE-2013-7273GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-…
• CVE-2013-7274Cross-site scripting (XSS) vulnerability in Wallpaper Script…
• CVE-2013-7275Cross-site scripting (XSS) vulnerability in misc.php in MyBB…
• CVE-2013-7276Cross-site scripting (XSS) vulnerability in inc/raf_form.php…
• CVE-2013-7278SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allo…
• CVE-2013-7279Cross-site scripting (XSS) vulnerability in views/video-mana…
• CVE-2013-7280Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and…
• CVE-2013-7281The dgram_recvmsg function in net/ieee802154/dgram.c in the …
• CVE-2013-7282The management web interface on the Nisuta NS-WIR150NE route…
• CVE-2013-7283Race condition in the libreswan.spec files for Red Hat Enter…