CVE-2012-1001

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
http://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
https://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.htmlBroken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/Broken Link
http://www.securityfocus.com/bid/52115Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52117Third Party Advisory, VDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6cPatch, Third Party Advisory
https://www.htbridge.ch/advisory/HTB23073Exploit, Third Party Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-100108.8A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settin CVE-2012-100119.8A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the funct CVE-2012-100128.8A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability CVE-2012-100136.1A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affe CVE-2012-100146.1A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function b CVE-2012-100158.8A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the func CVE-2012-100167.5A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an CVE-2012-100178.8A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an un CVE-2012-100188.3The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 r CVE-2012-100199.8The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php fil CVE-2012-100210.0SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the CVE-2012-100209.8The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in