CVE-2013-6880: Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary...

Security readout for executives and security teams

CVE-2013-6880 is an old FlashCanvas issue where a helper file, proxy.php, could redirect users to attacker-chosen sites and enable cross-site scripting through the HTTP Referer header. The main business risk is user deception or browser-side attack if vulnerable FlashCanvas files are still publicly reachable. Exposure is most likely in legacy web applications that bundled FlashCanvas before version 1.6 and still serve proxy.php publicly. Modern applications are unlikely affected unless old static assets or vendor libraries remain deployed. Prioritize this as a legacy hygiene issue unless discovery shows public exposure in a high-value application. The absence of CVSS and active exploitation evidence lowers urgency, but open redirect and XSS risks can still support phishing or browser compromise. Mitigation focus: Inventory web roots and repositories for FlashCanvas and proxy.php.; Upgrade FlashCanvas deployments older than 1.6 where still required.; Remove unused FlashCanvas files from public web paths..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.