CVE-2012-1296 Elefant CMS Multiple XSS Vulnerabilities
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elefant/cms(Packagist) | >= 1.0, < 1.0.2-Beta | 1.0.2-Beta |
| elefant/cms(Packagist) | >= 1.1, < 1.1.5-Beta | 1.1.5-Beta |
| elefantcms | <= 1.1.4_beta | No fix listed |
| elefantcms | = 1.1.1_beta | No fix listed |
| elefantcms | = 1.1.2_beta | No fix listed |
| elefantcms | = 1.1.3_beta | No fix listed |
| elefantcms | <= 1.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- elefantcms-preview-xss(73421) vdb-entry
- github.com product
- web.archive.org
- web.archive.org
- github.com
- 48118 third-party-advisory vendor-advisory
- www.elefantcms.com vendor-advisory
- www.elefantcms.com
- 52143 vdb-entry
- www.htbridge.com