Unscored severity · published Dec 21, 2012
CVE-2012-5181
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Concrete5 · Concrete5
5.5.0; 5.5.1; 5.5.1; 5.5.2; 5.5.2; 5.5.2.1; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5181
Patch
http://concrete5-japan.org/news/concrete5602ja-release/
Third Party Advisory
http://jvn.jp/en/jp/JVN65458431/index.html
Third Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000113
More from Concrete5
6.1
CVE-2017-6908
An issue was discovered in concrete5 <= 5.6.3.4
6.1
CVE-2017-6905
An issue was discovered in concrete5 <= 5.6.3.4
–
CVE-2015-3989
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages…
–
CVE-2015-2250
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to…
–
CVE-2014-9526
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName…