Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modi…

published 2019-11-19 6 y ago modified 2026-06-16 4 mo ago also EUVD-2011-3316

cvss: 4.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context of the affected website.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-3352 updated 2025-11-21 cvss 3.5

(v1.3.x): XSS flaw due improper sanitization of 'themename' parameter by setting default, modifying and deleting themes

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

immuniweb.com https://www.immuniweb.com/advisory/HTB23039 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

Zikula Zikula

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

immuniweb.com /advisory/HTB23039
exploit, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2011-3352
issue-tracking, third-party-advisory
access.redhat.com /security/cve/cve-2011-3352
broken-link

Sources

CVE List CVE-2011-3352
NVD CVE-2011-3352

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary