CVE-2012-0984

🗓️ 11 Sep 2014 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

Multiple XSS vulnerabilities in XOOPS before 2.5.5, allowing remote attackers to inject arbitrary web script or HTML

Reporter	Title	Published	Views	Family All 16
zdt	XOOPS 2.5.4 Cross Site Scripting	18 Apr 201200:00	–	zdt
Circl	CVE-2012-0984	18 Apr 201200:00	–	circl
Cvelist	CVE-2012-0984	11 Sep 201414:00	–	cvelist
Exploit DB	XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities	19 Apr 201200:00	–	exploitdb
Exploit DB	XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting	18 Apr 201200:00	–	exploitdb
Exploit DB	XOOPS 2.5.4 - '/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php' Multiple Cross-Site Scripting Vulnerabilities	18 Apr 201200:00	–	exploitdb
exploitpack	XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities	19 Apr 201200:00	–	exploitpack
htbridge	Multiple XSS vulnerabilities in XOOPS	7 Dec 201100:00	–	htbridge
NVD	CVE-2012-0984	11 Sep 201414:16	–	nvd
Packet Storm	XOOPS 2.5.4 Cross Site Scripting	18 Apr 201200:00	–	packetstorm

NVD

Node

xoops xoopsRange≤2.5.4

xoops xoopsMatch2.5.0

xoops xoopsMatch2.5.1

xoops xoopsMatch2.5.2

xoops xoopsMatch2.5.2rc

xoops xoopsMatch2.5.3

Source	Link
securityfocus	www.securityfocus.com/bid/53143
osvdb	www.osvdb.org/81212
exploit-db	www.exploit-db.com/exploits/18753
osvdb	www.osvdb.org/81213
secunia	www.secunia.com/advisories/48887
htbridge	www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html
archives	www.archives.neohapsis.com/archives/bugtraq/2012-04/0128.html
xoops	www.xoops.org/modules/news/article.php
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/75024
packetstormsecurity	www.packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
to_userid	request body	modules/pm/pmlite.php	XSS via unsanitized to_userid POST parameter in pmlite.php.	CWE-79
current_file	request body	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	XSS via unsanitized input in current_file/imgcat_id/target POST parameters to xoopsimagebrowser.php.	CWE-79
imgcat_id	request body	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	XSS via unsanitized input in current_file/imgcat_id/target POST parameters to xoopsimagebrowser.php.	CWE-79
target	request body	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	XSS via unsanitized input in current_file/imgcat_id/target POST parameters to xoopsimagebrowser.php.	CWE-79

16 Jun 2026 23:38Current

6Medium risk

Vulners AI Score6

CVSS 24.3

EPSS0.04162