CVE-2012-2452

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to modules.php or (2) img_url to includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.pragmamx.org/Forum-topic-33554.htmlIssue Tracking, Vendor Advisory
http://www.pragmamx.org/News-pragmaMx-1.12-Servicepack2-item-706.htmlVendor Advisory
https://www.htbridge.com/advisory/HTB23090Exploit, Third Party Advisory
http://www.pragmamx.org/Forum-topic-33554.htmlIssue Tracking, Vendor Advisory
http://www.pragmamx.org/News-pragmaMx-1.12-Servicepack2-item-706.htmlVendor Advisory
https://www.htbridge.com/advisory/HTB23090Exploit, Third Party Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-24556.4Advanced Productivity Software DTE Axiom before 12.3.3 does not validate the registration ID, which allows remote attackers to bypass authen CVE-2012-24595.0Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.6, 0.5.x before 0.5.5, 0.6.0.x before 0.6.0.7, and 0.6.x before 0.6.2 allows CVE-2012-24697.8Cisco NX-OS 4.2, 5.0, 5.1, and 5.2 on Nexus 7000 series switches, when the High Availability (HA) policy is configured for Reset, allows rem CVE-2012-24727.8Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 and 8.4, when SIP inspection is enabled, create many identica CVE-2012-24744.0Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 allows remote authenticated users CVE-2012-24868.3The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoin CVE-2012-24887.8Cisco IOS XR before 4.2.1 on ASR 9000 series devices and CRS series devices allows remote attackers to cause a denial of service (packet tra CVE-2012-24905.0Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors, aka Bug ID CSCtz0 CVE-2012-24939.3The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x CVE-2012-24944.3The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 CVE-2012-24954.3The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.602 CVE-2012-24966.8A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.