CVE-2012-5558

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-09 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym.

Affected products

Smiley Project Smiley: from 6.x-1.0 before 6.x-1.1 — fixed in 6.x-1.1
Smileys Project Smileys: from 6.x-1.0 before 6.x-1.1 — fixed in 6.x-1.1

How to fix

Upgrade to a fixed version: Smiley Project Smiley 6.x-1.1; Smileys Project Smileys 6.x-1.1. Check the vendor advisory for mitigations.

References

http://drupal.org/node/1840892
http://drupal.org/node/1840954
http://drupal.org/node/1840956
http://www.openwall.com/lists/oss-security/2012/11/20/4
http://drupal.org/node/1840892
http://drupal.org/node/1840954
http://drupal.org/node/1840956
http://www.openwall.com/lists/oss-security/2012/11/20/4

Get alerted when CVE-2012-5558 or the next vulnerability affects your stack