Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange…
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters.
Why it matters now
EPSS 0.02564 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ulli_horlacher:fex:*:*:*:*:*:*:*:* | up to 20111129 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110609:*:*:*:*:*:*:* | 20110609 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110610:*:*:*:*:*:*:* | 20110610 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110614:*:*:*:*:*:*:* | 20110614 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110615:*:*:*:*:*:*:* | 20110615 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110616:*:*:*:*:*:*:* | 20110616 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110621:*:*:*:*:*:*:* | 20110621 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110622:*:*:*:*:*:*:* | 20110622 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110627:*:*:*:*:*:*:* | 20110627 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110630:*:*:*:*:*:*:* | 20110630 | Vulnerable | Ulli Horlacher |
- cpe:2.3:a:ulli_horlacher:fex:*:*:*:*:*:*:*:* Versions up to 20111129 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110609:*:*:*:*:*:*:* Versions 20110609 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110610:*:*:*:*:*:*:* Versions 20110610 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110614:*:*:*:*:*:*:* Versions 20110614 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110615:*:*:*:*:*:*:* Versions 20110615 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110616:*:*:*:*:*:*:* Versions 20110616 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110621:*:*:*:*:*:*:* Versions 20110621 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110622:*:*:*:*:*:*:* Versions 20110622 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110627:*:*:*:*:*:*:* Versions 20110627 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110630:*:*:*:*:*:*:* Versions 20110630 Vulnerable ·Ulli Horlacher
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ulli_horlacher:fex:20110701:*:*:*:*:*:*:* | 20110701 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110714:*:*:*:*:*:*:* | 20110714 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110716:*:*:*:*:*:*:* | 20110716 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110722:*:*:*:*:*:*:* | 20110722 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110726:*:*:*:*:*:*:* | 20110726 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110727:*:*:*:*:*:*:* | 20110727 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110730:*:*:*:*:*:*:* | 20110730 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110731:*:*:*:*:*:*:* | 20110731 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110803:*:*:*:*:*:*:* | 20110803 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110807:*:*:*:*:*:*:* | 20110807 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110808:*:*:*:*:*:*:* | 20110808 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110809:*:*:*:*:*:*:* | 20110809 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110810:*:*:*:*:*:*:* | 20110810 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110811:*:*:*:*:*:*:* | 20110811 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110813:*:*:*:*:*:*:* | 20110813 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110826:*:*:*:*:*:*:* | 20110826 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110829:*:*:*:*:*:*:* | 20110829 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110830:*:*:*:*:*:*:* | 20110830 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110901:*:*:*:*:*:*:* | 20110901 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110905:*:*:*:*:*:*:* | 20110905 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110906:*:*:*:*:*:*:* | 20110906 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110907:*:*:*:*:*:*:* | 20110907 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110919:*:*:*:*:*:*:* | 20110919 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110920:*:*:*:*:*:*:* | 20110920 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110921:*:*:*:*:*:*:* | 20110921 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20110930:*:*:*:*:*:*:* | 20110930 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111003:*:*:*:*:*:*:* | 20111003 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111005:*:*:*:*:*:*:* | 20111005 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111013:*:*:*:*:*:*:* | 20111013 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111028:*:*:*:*:*:*:* | 20111028 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111102:*:*:*:*:*:*:* | 20111102 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111108:*:*:*:*:*:*:* | 20111108 | Vulnerable | Ulli Horlacher |
| cpe:2.3:a:ulli_horlacher:fex:20111115:*:*:*:*:*:*:* | 20111115 | Vulnerable | Ulli Horlacher |
- cpe:2.3:a:ulli_horlacher:fex:20110701:*:*:*:*:*:*:* Versions 20110701 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110714:*:*:*:*:*:*:* Versions 20110714 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110716:*:*:*:*:*:*:* Versions 20110716 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110722:*:*:*:*:*:*:* Versions 20110722 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110726:*:*:*:*:*:*:* Versions 20110726 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110727:*:*:*:*:*:*:* Versions 20110727 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110730:*:*:*:*:*:*:* Versions 20110730 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110731:*:*:*:*:*:*:* Versions 20110731 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110803:*:*:*:*:*:*:* Versions 20110803 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110807:*:*:*:*:*:*:* Versions 20110807 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110808:*:*:*:*:*:*:* Versions 20110808 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110809:*:*:*:*:*:*:* Versions 20110809 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110810:*:*:*:*:*:*:* Versions 20110810 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110811:*:*:*:*:*:*:* Versions 20110811 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110813:*:*:*:*:*:*:* Versions 20110813 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110826:*:*:*:*:*:*:* Versions 20110826 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110829:*:*:*:*:*:*:* Versions 20110829 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110830:*:*:*:*:*:*:* Versions 20110830 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110901:*:*:*:*:*:*:* Versions 20110901 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110905:*:*:*:*:*:*:* Versions 20110905 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110906:*:*:*:*:*:*:* Versions 20110906 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110907:*:*:*:*:*:*:* Versions 20110907 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110919:*:*:*:*:*:*:* Versions 20110919 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110920:*:*:*:*:*:*:* Versions 20110920 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110921:*:*:*:*:*:*:* Versions 20110921 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20110930:*:*:*:*:*:*:* Versions 20110930 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111003:*:*:*:*:*:*:* Versions 20111003 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111005:*:*:*:*:*:*:* Versions 20111005 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111013:*:*:*:*:*:*:* Versions 20111013 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111028:*:*:*:*:*:*:* Versions 20111028 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111102:*:*:*:*:*:*:* Versions 20111102 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111108:*:*:*:*:*:*:* Versions 20111108 Vulnerable ·Ulli Horlacher
- cpe:2.3:a:ulli_horlacher:fex:20111115:*:*:*:*:*:*:* Versions 20111115 Vulnerable ·Ulli Horlacher
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-1293
- 2026-10-03 Alias added: GHSA-gff9-66qm-g2w3
References
Advisory 1
Other 5
- 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.
- [oss-security] 20120223 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.
- 79420
- [oss-security] 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.
- 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.
More Ulli Horlacher Fex vulnerabilities
- TI-2014-03149 The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before… CVSS 3.1MEDIUM 6.1
- TI-2012-00804 Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka… CVSS 2.0MEDIUM 4.3
- TI-2011-01234 Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before… CVSS 2.0MEDIUM 5.0
- TI-2014-03151 Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before… CVSS 2.0MEDIUM 4.3
- TI-2014-03150 Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-1293 · CVE Program
- CVE-2012-1293 · NVD
- FIRST EPSS
- GHSA-gff9-66qm-g2w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences