CVE-2012-0976

🗓️ 02 Feb 2012 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 70 Views🌐 WEB

Cross-site scripting (XSS) vuln in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter

Reporter	Title	Published	Views	Family All 9
Cvelist	CVE-2012-0976	2 Feb 201217:00	–	cvelist
EUVD	EUVD-2012-0999	7 Oct 202500:30	–	euvd
Mend	CVE-2012-0976	2 Feb 201217:00	–	mend
NVD	CVE-2012-0976	2 Feb 201217:55	–	nvd
Prion	Cross site scripting	2 Feb 201217:55	–	prion
Prion	Cross site scripting	17 Sep 201217:55	–	prion
Positive Technologies	PT-2012-2982	2 Feb 201200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2012-0976: Improper Neutralization of Input During Web Page Generation	2 Feb 201200:00	–	rapid7
RedhatCVE	CVE-2012-4968	22 May 202512:06	–	redhatcve

NVD

Node

silverstripe silverstripeMatch2.4.6

Source	Link
packetstormsecurity	www.packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt
github	www.github.com/silverstripe/sapphire/commit/252e187
github	www.github.com/silverstripe/sapphire/commit/475e077
doc	www.doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13
openwall	www.openwall.com/lists/oss-security/2012/04/30/3
github	www.github.com/silverstripe/sapphire/commit/5fe7091
securityfocus	www.securityfocus.com/bid/51761
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/72820
osvdb	www.osvdb.org/78677
secunia	www.secunia.com/advisories/47812

Parameter	Position	Path	Description	CWE
Title	request body	admin/EditForm	XSS vulnerability in admin/EditForm: Title parameter can be injected with arbitrary script/HTML by authenticated Content Authors.	CWE-79

16 Jun 2026 23:38Current

5.4Medium risk

Vulners AI Score5.4

CVSS 22.1

EPSS0.01914

CWE-79