Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

ZF-Commons ZfcUser login page allows script injection

CVE-2015-1039 · published 11 years ago
Summary

A user can inject malicious code into the ZF-Commons ZfcUser login page, potentially stealing user data or taking control of accounts. If you're using ZF-Commons ZfcUser version 1.2.2 or earlier, update to version 1.2.2 or later to fix this vulnerability.

What to do
  • Update zf-commons zfc-user to version 1.2.2.
Affected software
Ecosystem VendorProductAffected versions
composer zf-commons zfc-user < 1.2.2
Fix: upgrade to 1.2.2
– zfcuser_project zfcuser <= 1.2.1
cpe:2.3:a:zfcuser_project:zfcuser:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Jan 2015
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-33rh-5hvf-5jjp · GHSA
CVE-2015-1039 · NVD
Track software like this
Free during beta