CVE-2012-1000 Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admin...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lepton-cms lepton | <= 1.1.3 | No fix listed |
| lepton-cms lepton | = 1.1.0 | No fix listed |
| lepton-cms lepton | = 1.1.1 | No fix listed |
| lepton-cms lepton | = 1.1.2 | No fix listed |
References
- www.lepton-cms.org
- www.lepton-cms.org patch vendor-advisory
- www.htbridge.ch exploit