CVE-2012-6667

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/48525Third Party Advisory
http://www.exploit-db.com/exploits/18644Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52685Third Party Advisory, VDB Entry
http://secunia.com/advisories/48525Third Party Advisory
http://www.exploit-db.com/exploits/18644Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52685Third Party Advisory, VDB Entry

Timeline

Published: Jan 11, 2018
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-66686.1Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBul CVE-2012-66706.1Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote CVE-2012-66716.1Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for v CVE-2012-66826.1Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and e CVE-2012-66844.3Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web CVE-2012-66857.5Nokogiri before 1.5.4 is vulnerable to XXE attacks CVE-2012-66875.0FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number CVE-2012-66897.8The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows CVE-2012-66916.8Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the au CVE-2012-66924.3Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote CVE-2012-669310.0GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasrw for the nasrw (Read CVE-2012-669410.0GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unsp