CVE-2012-3830

Decoda < 3.3.3 - Cross-Site Scripting via Video Directive

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-3830.

AI-analyzed exploit summary This advisory details a cross-site scripting (XSS) vulnerability in php-decoda versions 3.x, where improper encoding of user input in video tags allows attackers to inject JavaScript event handlers into iframe tags. The vulnerability is demonstrated with a proof-of-concept exploit that triggers an alert dialog.

Description

Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.

Exploits (1)

exploitdb WRITEUP
webappsphp
https://www.exploit-db.com/exploits/18822

This advisory details a cross-site scripting (XSS) vulnerability in php-decoda versions 3.x, where improper encoding of user input in video tags allows attackers to inject JavaScript event handlers into iframe tags. The vulnerability is demonstrated with a proof-of-concept exploit that triggers an alert dialog.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: php-decoda 3.x
No auth needed
Prerequisites: Access to a web application using php-decoda with video tag support enabled
MITRE ATT&CK
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53332
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/81637
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48931
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75333

Scores

EPSS 0.0375
EPSS Percentile 88.5%

Details

CWE
CWE-79
Status published
Products (13)
milesj/decoda 2.2
milesj/decoda 2.3
milesj/decoda 2.4
milesj/decoda 2.5
milesj/decoda 2.6
milesj/decoda 2.7
milesj/decoda 2.8
milesj/decoda 2.9
milesj/decoda 3.0
milesj/decoda 3.1
... and 3 more
Published Jul 03, 2012
Tracked Since Feb 18, 2026