CVE-2012-1597

Ezjscore < 1.4 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Yann MICHARD · textwebappsphp

https://www.exploit-db.com/exploits/37024

View Code ZIP pw:eip

References (3)

[Various Sources] http://share.ez.no/community-project/security-advisories/ezsa-2012-006-xss-exploit-on-ezjscore-run-command-when-using-firefox

[Exploit, Patch] https://github.com/ezsystems/ezjscore/commit/58854564c7b8672090c25c4b1677d08620d870f2

[Mailing List] http://www.openwall.com/lists/oss-security/2012/05/11/6

Scores

EPSS 0.0273

EPSS Percentile 85.8%

Classification

CWE

CWE-79

Status published

Affected Products (3)

ez/ezjscore < 1.4

ez/ezjscore

n/a/n/a

Timeline

Published Aug 17, 2012

Tracked Since Feb 18, 2026