CVE-2013-6837 describes a cross-site scripting (XSS) vulnerability in the setTimeout function of the prettyPhoto 3.1.4 and earlier JavaScript library, specifically within the js/jquery.prettyPhoto.js file. This flaw allows remote attackers to inject arbitrary web script or HTML by crafting a malicious PATH_INFO in the default URI. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and requiring no authentication, leading to a partial impact on integrity (e.g., defacement, session hijacking) but no impact on confidentiality or availability. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, and no public exploit code is available via Metasploit, Nuclei, or ExploitDB. The CVE has received no community discussion or media coverage, further indicating a lack of widespread attention or exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.1.4CPE matchmatch criteria | cpe:2.3:a:no-margin-for-errors:prettyphoto:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.