Unscored severity · published Feb 8, 2012
CVE-2012-1004
Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foswiki · Foswiki
1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.4; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1004
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1004
Vendor Advisory
http://foswiki.org/Support/SecurityAlert-CVE-2012-1004
foswiki.org
http://foswiki.org/Tasks/Item11498
foswiki.org
http://foswiki.org/Tasks/Item11501
Vendor Advisory
http://secunia.com/advisories/47849
st2tea.blogspot.com
http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html
More from Foswiki
9.8
CVE-2013-1666
Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro
7.5
CVE-2023-33756
An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal
7.5
CVE-2023-24698
Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web…
5.3
CVE-2026-2861
Foswiki Changes/Viewfile/Oops information disclosure
–
CVE-2012-6330
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory…