CVE-2012-3869

Redaxo - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.

References (5)

[Exploit] http://archives.neohapsis.com/archives/bugtraq/2012-07/0142.html

[Vendor Advisory] http://secunia.com/advisories/49904

[Various Sources] http://www.redaxo.org/de/download/sicherheitshinweise/

[Exploit] http://www.securityfocus.com/bid/54670

[Exploit] https://www.htbridge.com/advisory/HTB23098

Scores

EPSS 0.0045

EPSS Percentile 63.2%

Classification

CWE

CWE-79

Status published

Affected Products (6)

redaxo/redaxo

n/a/n/a

Timeline

Published Aug 13, 2012

Tracked Since Feb 18, 2026