CVE-2012-2436 Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize act...
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in the karma module; (4) q_1_low, (5) q_1_high, (6) q_2_low, or (7) q_2_high parameter in a configure action to module.php in the captcha module; or (8) the edit parameter to module.php in the admin_language module.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pligg cms | All versions | No fix listed |
| pligg cms | <= 1.2.1 | No fix listed |
| pligg cms | = 1.0.0 | No fix listed |
| pligg cms | = 1.0.0-rc1 | No fix listed |
| pligg cms | = 1.0.0-rc2 | No fix listed |
| pligg cms | = 1.0.0-rc3 | No fix listed |
| pligg cms | = 1.0.0-rc4 | No fix listed |
| pligg cms | = 1.0.0-rc5 | No fix listed |
| pligg cms | = 1.0.1 | No fix listed |
| pligg cms | = 1.0.2 | No fix listed |
| pligg cms | = 1.0.3 | No fix listed |
| pligg cms | = 1.0.4 | No fix listed |
| pligg cms | = 1.1.0 | No fix listed |
| pligg cms | = 1.1.2 | No fix listed |
| pligg cms | = 1.1.3 | No fix listed |
| pligg cms | = 1.1.4 | No fix listed |
| pligg cms | = 1.1.5 | No fix listed |
| pligg cms | = 1.2.0 | No fix listed |
| pligg cms | = 9.5 | No fix listed |
| pligg cms | = 9.9 | No fix listed |
| pligg cms | = 9.9.0 | No fix listed |
| pligg cms | = 9.9.0-beta | No fix listed |
| pligg cms | = 9.9.5 | No fix listed |
| pligg cms | = 9.9.5-beta | No fix listed |
References
- forums.pligg.com
- pligg.svn.sourceforge.net
- pligg.svn.sourceforge.net
- pligg.svn.sourceforge.net
- pligg.svn.sourceforge.net
- 45431 third-party-advisory vendor-advisory
- 49257 third-party-advisory
- secunia.com vendor-advisory
- 53625 vdb-entry
- 53662 vdb-entry
- pliggcms-multiple1-xss(75764) vdb-entry
- pliggcms-adminindex-xss(75834) vdb-entry
- www.htbridge.com