cbcvebase.
CVE-2012-2156
published 2012-04-11

CVE-2012-2156: Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the…

PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
3.81%
88.7th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to manager/users.php, or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section.

Affected

11 ranges
VendorProductVersion rangeFixed in
plume-cmsplume_cms<= 1.2.4—
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
plume-cmsplume_cms——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.