CVE-2011-2461

Adobe Flex SDK 3.x and 4.x < 4.6 - Cross-Site Scripting via Module Loading

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2011-2461. PoCs published by ikkisoft, edmondscommerce, u-maxx.

AI-analyzed exploit summary ParrotNG is a Java-based tool that detects Adobe Flex applications (SWF files) vulnerable to CVE-2011-2461 by analyzing SWF metadata. It includes both a command-line utility and a Burp Suite passive scanner plugin.

Description

Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.

Exploits (3)

nomisec SCANNER 48 stars
by ikkisoft · poc
https://github.com/ikkisoft/ParrotNG

ParrotNG is a Java-based tool that detects Adobe Flex applications (SWF files) vulnerable to CVE-2011-2461 by analyzing SWF metadata. It includes both a command-line utility and a Burp Suite passive scanner plugin.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Adobe Flex SDK versions 3.x to 4.5.1
No auth needed
Prerequisites: Access to SWF files compiled with vulnerable Flex SDK versions
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by edmondscommerce · poc
https://github.com/edmondscommerce/CVE-2011-2461_Magento_Patch

This repository provides patched versions of Magento's Flex .swf files to mitigate CVE-2011-2461, a CSRF vulnerability in Adobe Flex components. It includes references to external technical analyses but does not contain exploit code.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Magento (Flex .swf files)
No auth needed
Prerequisites: Access to Magento admin interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by u-maxx · poc
https://github.com/u-maxx/magento-swf-patched-CVE-2011-2461

This repository provides patched versions of Magento's uploader.swf and uploaderSingle.swf files to mitigate CVE-2011-2461, a vulnerability in Adobe Flex SDK. It includes references to technical analysis and tools for patching SWF files.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Magento eCommerce (Adobe Flex SDK)
No auth needed
Prerequisites: Vulnerable SWF files in Magento installation
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (7)

Core 7

Scores

EPSS 0.0797
EPSS Percentile 94.0%

Details

CWE
CWE-79
Status published
Products (14)
adobe/flex_sdk 3.0
adobe/flex_sdk 3.0.1
adobe/flex_sdk 3.1
adobe/flex_sdk 3.2
adobe/flex_sdk 3.3
adobe/flex_sdk 3.4
adobe/flex_sdk 3.4.1
adobe/flex_sdk 3.5
adobe/flex_sdk 3.5a
adobe/flex_sdk 3.6
... and 4 more
Published Dec 01, 2011
Tracked Since Feb 18, 2026