CVE-2012-6528

Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) themes/default/tile_search/index.tmpl.php, (2) login.php, (3) search.php, (4) password_reminder.php, (5) login.php/jscripts/infusion, (6) login.php/mods/_standard/flowplayer, (7) browse.php/jscripts/infusion/framework/fss, (8) registration.php/themes/default/ie_styles.css, (9) about.php, or (10) themes/default/social/basic_profile.tmpl.php.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.85% chance of exploitation in the next 30 days, 78th percentile

Published

2013-01-31

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/36565

References

• CVE Record
• NVD entry

Related

• CVE-2012-6526
• CVE-2012-6529
• CVE-2012-6525
• CVE-2012-6530
• CVE-2012-6524
• CVE-2012-6533