Is CVE-2013-20006 actively exploited?

No active exploitation of CVE-2013-20006 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2013-20006 be exploited remotely?

Yes. CVE-2013-20006 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2013-20006?

CVE-2013-20006 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2013-20006

HIGH

CVE-2013-20006

CWE-79Published: March 16, 2026· Updated: Mar 16, 2026

7.5

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.0th

Official Description

Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.

NVD Source

Technical Analysis

CVE-2013-20006 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.