CVE-2012-5452

🗓️ 22 Oct 2012 23:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allowing remote attackers to inject arbitrary web script or HTML via various parameters

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2012-5452	22 Oct 201200:00	–	circl
Cvelist	CVE-2012-5452	22 Oct 201223:00	–	cvelist
NVD	CVE-2012-5452	22 Oct 201223:55	–	nvd
Prion	Cross site scripting	22 Oct 201223:55	–	prion
Prion	Cross site scripting	22 Oct 201223:55	–	prion
Prion	Cross site scripting	22 Oct 201223:55	–	prion
RedhatCVE	CVE-2011-5211	22 May 202509:56	–	redhatcve

NVD

Node

intelliants subrion_cmsMatch2.2.1

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/78467
packetstormsecurity	www.packetstormsecurity.org/files/116434/Subrion-CMS-2.2.1-Cross-Site-Scripting.html
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5105.php
securityfocus	www.securityfocus.com/bid/55502
subrion	www.subrion.com/forums/announcements/893-subrion-open-source-cms-2-2-2-has-been-released.html
secunia	www.secunia.com/advisories/44917
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/78468
packetstormsecurity	www.packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html
htbridge	www.htbridge.com/advisory/HTB23113

Parameter	Position	Path	Description	CWE
multi_title	request body	blocks/add/	Stored/Reflected XSS via multi_title parameter in blocks/add/.	CWE-79
cost	request body	plans/add/	XSS via cost, days, or title[en] parameters in plans/add/.	CWE-79
days	request body	plans/add/	XSS via cost, days, or title[en] parameters in plans/add/.	CWE-79
title[en]	request body	plans/add/	XSS via cost, days, or title[en] parameters in plans/add/.	CWE-79
name	request body	admin/manage/fields/group/add/	XSS via name or title[en] parameters in fields/group/add/ under admin/manage/.	CWE-79
title[en]	request body	admin/manage/fields/group/add/	XSS via name or title[en] parameters in fields/group/add/ under admin/manage/.	CWE-79
f[accounts][fullname]	nested	advsearch/	XSS via f[accounts][fullname] or f[accounts][username] parameters to advsearch/.	CWE-79
f[accounts][username]	nested	advsearch/	XSS via f[accounts][fullname] or f[accounts][username] parameters to advsearch/.	CWE-79

16 Jun 2026 23:46Current

5.6Medium risk

Vulners AI Score5.6

CVSS 24.3

EPSS0.05077

CWE-79