CVE-2012-1979

Syndeocms < 3.0.01 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Ivano Binetti · textwebappsphp

https://www.exploit-db.com/exploits/18686

View Code ZIP pw:eip

References (6)

[Exploit, Third Party Advisory] http://packetstormsecurity.org/files/111405/SyndeoCMS-3.0.01-Cross-Site-Scripting.html

[Exploit] http://www.exploit-db.com/exploits/18686/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/52840

[Exploit] http://www.webapp-security.com/wp-content/uploads/2012/03/syndeocms_3.0.01-Persistent-XSS.txt

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/74545

[Third Party Advisory, VDB Entry] http://osvdb.org/80746

Scores

EPSS 0.0087

EPSS Percentile 75.0%

Classification

CWE

CWE-79

Status published

Affected Products (13)

syndeocms/syndeocms < 3.0.01

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

syndeocms/syndeocms

n/a/n/a

Timeline

Published Apr 17, 2012

Tracked Since Feb 18, 2026