CVE-2012-0873

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-02-23 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

Affected products

Boonex Dolphin: through 7.0.7; 5.1, 5.2, 6.1.2, 7.0.0, 7.0.1, 7.0.2 (+5)

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html
http://www.boonex.com/n/dolphin-7-0-8-released
http://www.boonex.com/trac/dolphin/changeset/15282
http://www.boonex.com/trac/dolphin/changeset/15283
http://www.boonex.com/trac/dolphin/ticket/2530
http://www.openwall.com/lists/oss-security/2012/02/20/11
http://www.openwall.com/lists/oss-security/2012/02/20/6
http://www.securityfocus.com/bid/52088
http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss
http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html
http://www.boonex.com/n/dolphin-7-0-8-released
http://www.boonex.com/trac/dolphin/changeset/15282

Get alerted when CVE-2012-0873 or the next vulnerability affects your stack