CVE-2013-7250: Projectforge

Low severity, CVSS 3.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java.

Affected products

• Projectforge Projectforge: up to and including 5.2; version 5.0 only; version 5.1 only

Published 2014-01-02. Last modified 2026-06-17.