CVE-2012-1211

Powie pFile 1.02 - Cross-Site Scripting via filecat Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-1211. PoCs published by indoushka.

AI-analyzed exploit summary The code describes a cross-site scripting (XSS) and SQL injection vulnerability in pfile 1.02 due to improper input sanitization. It provides a sample exploit URL but lacks executable PoC code.

Description

Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by indoushka · textwebappsphp
https://www.exploit-db.com/exploits/36765

The code describes a cross-site scripting (XSS) and SQL injection vulnerability in pfile 1.02 due to improper input sanitization. It provides a sample exploit URL but lacks executable PoC code.

Classification
Writeup 80%
Attack Type
Xss | Sqli
Complexity
Trivial
Reliability
Theoretical
Target: pfile 1.02
No auth needed
Prerequisites: access to the vulnerable web application
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/73165
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51982

Scores

EPSS 0.0160
EPSS Percentile 73.0%

Details

CWE
CWE-79
Status published
Products (1)
powie/pfile 1.02
Published Feb 24, 2012
Tracked Since Feb 18, 2026