CVE-2012-4890

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-09-10 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2011 08.09.2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) comment to the news, (2) title to the news, or (3) the folder names in a gallery.

Affected products

Flatnux: through 2011-08-09-2; 2008-12-11, 2009-01-27, 2009-02-04

References

http://packetstormsecurity.org/files/111473/Flatnux-CMS-2011-08.09.2-CSRF-XSS-Directory-Traversal.html
http://secunia.com/advisories/48656
http://secunia.com/advisories/48676
http://www.osvdb.org/80877
http://www.securityfocus.com/bid/52846
http://www.vulnerability-lab.com/get_content.php?id=487
https://exchange.xforce.ibmcloud.com/vulnerabilities/74566
http://packetstormsecurity.org/files/111473/Flatnux-CMS-2011-08.09.2-CSRF-XSS-Directory-Traversal.html
http://secunia.com/advisories/48656
http://secunia.com/advisories/48676
http://www.osvdb.org/80877
http://www.securityfocus.com/bid/52846

Get alerted when CVE-2012-4890 or the next vulnerability affects your stack