Medium severity4.8NVD Advisory· Published Nov 19, 2019· Updated Jun 16, 2026

CVE-2011-3352

Description

Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting themes. A remote attacker with Zikula administrator privilege could use this flaw to execute arbitrary HTML or web script code in the context of the affected website.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ziku/Zikula
cpe:2.3:a:ziku:zikula:*:*:*:*:*:*:*:*
Range: <=1.3.0
Zikula/Zikulallm-fuzzy2 versions
= 1.3.0 build #3168+ 1 more
- (no CPE)range: = 1.3.0 build #3168
- (no CPE)range: 1.3.0 build #3168 and probably prior

Patches

Vulnerability mechanics

References

www.immuniweb.com/advisory/HTB23039nvdExploitThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
access.redhat.com/security/cve/cve-2011-3352nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000