PT-2026-25715 · Undefined · Undefined

Published 2026-03-15 · Updated 2026-03-16 · CVE-2013-20006

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qool CMS (affected versions not specified)

Description Qool CMS has multiple persistent cross-site scripting issues in several administrative scripts. The application does not properly sanitize POST parameters before storing and returning them to users. This allows attackers to inject malicious JavaScript code through parameters such as title, name, email, username, link, and task. The injection can occur in the following API endpoints: addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-20006

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-20006 · Security Note
• https://exploit-db.com/exploits/24627 · Note
• https://vulncheck.com/advisories/qool-cms-multiple-persistent-cross-site-scripting-vulnerabilities · Note
• http://zeroscience.mk/en/vulnerabilities/ZSL-2013-5133.php · Note
• https://t.me/CVEtracker/47442 · Telegram Post