CVE-2013-7250: Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allow...

Security readout for executives and security teams

ProjectForge before 5.3 had an authenticated cross-site scripting flaw in autocomplete handling. A logged-in user could submit text that becomes script or HTML in another browser context. The main business risk is account/session abuse or misleading internal users inside ProjectForge, not direct server takeover based on the available sources. Exposure is likely limited to organizations still running ProjectForge versions before 5.3, especially deployments with many authenticated users or externally reachable login portals. The source bundle does not identify affected CPEs or downstream packaged products. Treat this as a targeted internal web-application risk. Prioritize remediation for exposed or multi-user ProjectForge deployments, but it is not supported as critical from the provided evidence because authentication is required and active exploitation is not documented. Mitigation focus: Upgrade ProjectForge to 5.3 or later where feasible.; Review ProjectForge vendor issue PF-483 and the linked upstream commit.; Restrict ProjectForge access to trusted networks and users until remediated..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.