Unscored severity · published Aug 12, 2012
CVE-2012-3952
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phplist · Phplist
through 2.10.18; 2.6.5; 2.7.1; 2.7.2; 2.8.2; 2.8.7; +17 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3952
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3952
Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html
osvdb.org
http://osvdb.org/84482
Vendor Advisory
http://secunia.com/advisories/50150
www.phplist.com
http://www.phplist.com/?lid=579
Exploit
http://www.securityfocus.com/bid/54887
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/77526
More from Phplist
9.8
CVE-2017-20032
A vulnerability was found in PHPList 3.2.6
9.8
CVE-2017-20029
A vulnerability was found in PHPList 3.2.6 and classified as critical
9.8
CVE-2020-22249
Remote Code Execution vulnerability in phplist 3.5.1
9.8
CVE-2020-23361
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively…
9.8
CVE-2021-3188
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports