CVE-2013-7485

Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.

• CWE-79

• http://osvdb.org/100385Broken Link
• http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/bugtraq/2013/Nov/127Mailing List, Third Party Advisory
• http://secunia.com/advisories/55837Third Party Advisory
• http://www.securitytracker.com/id/1029394Third Party Advisory, VDB Entry
• http://xforce.iss.net/xforce/xfdb/89250Broken Link
• http://xforce.iss.net/xforce/xfdb/89251Broken Link
• https://forum.open-xchange.com/showthread.php?8090-Open-Xchange-releases-Security-Patch-2013-10-30-for-v7-2-2-and-v7-4-0Vendor Advisory
• http://osvdb.org/100385Broken Link
• http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/bugtraq/2013/Nov/127Mailing List, Third Party Advisory
• http://secunia.com/advisories/55837Third Party Advisory
• http://www.securitytracker.com/id/1029394Third Party Advisory, VDB Entry
• http://xforce.iss.net/xforce/xfdb/89250Broken Link
• http://xforce.iss.net/xforce/xfdb/89251Broken Link
• https://forum.open-xchange.com/showthread.php?8090-Open-Xchange-releases-Security-Patch-2013-10-30-for-v7-2-2-and-v7-4-0Vendor Advisory

Published

Jan 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-7479The events-manager plugin before 5.3.9 for WordPress has XSS…
• CVE-2013-7480The events-manager plugin before 5.3.6.1 for WordPress has X…
• CVE-2013-7481The contact-form-plugin plugin before 3.3.5 for WordPress ha…
• CVE-2013-7482The reflex-gallery plugin before 1.4.3 for WordPress has XSS…
• CVE-2013-7483The slidedeck2 plugin before 2.3.5 for WordPress has file in…
• CVE-2013-7484Zabbix before 5.0 represents passwords in the users table wi…7.5
• CVE-2013-7486Cross-site scripting (XSS) vulnerability in the backend in O…6.1
• CVE-2013-7487On Swann DVR04B, DVR08B, DVR-16CIF, and DVR16B devices, rays…9.8
• CVE-2013-7488perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) th…7.5
• CVE-2013-7489The Beaker library through 1.11.0 for Python is affected by …6.8
• CVE-2013-7490An issue was discovered in the DBI module before 1.632 for P…5.3
• CVE-2013-7491An issue was discovered in the DBI module before 1.628 for P…5.3