CVE-2012-0984

🗓️ 11 Sep 2014 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 74 Views🌐 WEB

Multiple XSS vulnerabilities in XOOPS before 2.5.5, allowing remote attackers to inject arbitrary web script or HTML

Reporter	Title	Published	Views	Family All 14
zdt	XOOPS 2.5.4 Cross Site Scripting	18 Apr 201200:00	–	zdt
Circl	CVE-2012-0984	18 Apr 201200:00	–	circl
Cvelist	CVE-2012-0984	11 Sep 201414:00	–	cvelist
Exploit DB	XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities	19 Apr 201200:00	–	exploitdb
Exploit DB	XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting	18 Apr 201200:00	–	exploitdb
Exploit DB	XOOPS 2.5.4 - '/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php' Multiple Cross-Site Scripting Vulnerabilities	18 Apr 201200:00	–	exploitdb
exploitpack	XOOPS 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities	19 Apr 201200:00	–	exploitpack
htbridge	Multiple XSS vulnerabilities in XOOPS	7 Dec 201100:00	–	htbridge
NVD	CVE-2012-0984	11 Sep 201414:16	–	nvd
Packet Storm	XOOPS 2.5.4 Cross Site Scripting	18 Apr 201200:00	–	packetstorm

NVD

Node

xoops xoopsRange≤2.5.4

xoops xoopsMatch2.5.0

xoops xoopsMatch2.5.1

xoops xoopsMatch2.5.2

xoops xoopsMatch2.5.2rc

xoops xoopsMatch2.5.3

Source	Link
securityfocus	www.securityfocus.com/bid/53143
osvdb	www.osvdb.org/81212
exploit-db	www.exploit-db.com/exploits/18753
osvdb	www.osvdb.org/81213
secunia	www.secunia.com/advisories/48887
htbridge	www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html
archives	www.archives.neohapsis.com/archives/bugtraq/2012-04/0128.html
xoops	www.xoops.org/modules/news/article.php
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/75024
packetstormsecurity	www.packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
to_userid	request body	modules/pm/pmlite.php	Reflected XSS via to_userid POST parameter in pmlite.php	CWE-79
current_file	request body	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	Reflected XSS via current_file POST parameter in image browser	CWE-79
imgcat_id	request body	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	Reflected XSS via imgcat_id POST parameter in image browser	CWE-79
target	query param	class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php	Reflected XSS via target query parameter in image browser	CWE-79

16 Jun 2026 23:38Current

5.7Medium risk

Vulners AI Score5.7

CVSS 24.3

EPSS0.04162