CVE-2011-3352

The CVE-2011-3352 entry describes a cross-site scripting (XSS) flaw in Zikula 1.3.0 build #3168 and probably earlier, caused by improper sanitization of the 'themename' parameter when managing themes. A remote attacker with Zikula administrator privileges could inject arbitrary HTML or web script...