Unscored severity · published Jun 27, 2012
CVE-2012-2706
Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to user registration.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Post Affiliate Pro · Peter Pokrivcak
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2706
Vendor Advisory
http://drupal.org/node/1585648
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/14/3
www.securityfocus.com
http://www.securityfocus.com/bid/53589
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75716
More from Post Affiliate Pro
–
CVE-2012-3802
Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of other users via unknown attack vectors