CVE-2012-6433

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 3, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-64346.8Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the autCVE-2012-64357.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/CVE-2012-64367.5The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port CVE-2012-64379.8The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet caCVE-2012-64387.5The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port CVE-2012-64398.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 4481CVE-2012-64404.8The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of CVE-2012-64415.0An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2CVE-2012-64427.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/CVE-2012-64474.3Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script CVE-2012-64486.1Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecCVE-2012-64495.4The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.