CVE-2012-0253 Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Dire...
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb parameter to sys/jsonp.app/.htm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| demandmedia pluck sitelife | <= 5.0.12 | No fix listed |
References
- 48778 third-party-advisory
- VU#400619 exploit third-party-advisory us-government-resource
- www.kb.cert.org us-government-resource
- 52968 vdb-entry
- plucksitelife-multiple-xss(74805) vdb-entry