Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in…
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.
Why it matters now
EPSS 0.01284 70th percentileScored 2026-11-07
Fix Fixed elefant/cms (Packagist): 1.0.2-Beta, 1.1.5-Beta
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | elefant/cms (Packagist) | 1.0 to before 1.0.2-Beta | 1.0.2-Beta | Patch available | GHSA-qjjq-rcq8-jw6j |
| — | elefant/cms (Packagist) | 1.1 to before 1.1.5-Beta | 1.1.5-Beta | Patch available | GHSA-qjjq-rcq8-jw6j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- elefant/cms (Packagist) Vendor— Affected 1.0 to before 1.0.2-Beta Fixed in 1.0.2-Beta Patch available GHSA-qjjq-rcq8-jw6j
- elefant/cms (Packagist) Vendor— Affected 1.1 to before 1.1.5-Beta Fixed in 1.1.5-Beta Patch available GHSA-qjjq-rcq8-jw6j
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elefantcms:elefantcms:*:*:*:*:*:*:*:* | up to 1.1.4_beta | Vulnerable | Elefant |
| cpe:2.3:a:elefantcms:elefantcms:1.1.1_beta:*:*:*:*:*:*:* | 1.1.1_beta | Vulnerable | Elefant |
| cpe:2.3:a:elefantcms:elefantcms:1.1.2_beta:*:*:*:*:*:*:* | 1.1.2_beta | Vulnerable | Elefant |
| cpe:2.3:a:elefantcms:elefantcms:1.1.3_beta:*:*:*:*:*:*:* | 1.1.3_beta | Vulnerable | Elefant |
| cpe:2.3:a:elefantcms:elefantcms:*:*:*:*:*:*:*:* | up to 1.0.1 | Vulnerable | Elefant |
- cpe:2.3:a:elefantcms:elefantcms:*:*:*:*:*:*:*:* Versions up to 1.1.4_beta Vulnerable ·Elefant
- cpe:2.3:a:elefantcms:elefantcms:1.1.1_beta:*:*:*:*:*:*:* Versions 1.1.1_beta Vulnerable ·Elefant
- cpe:2.3:a:elefantcms:elefantcms:1.1.2_beta:*:*:*:*:*:*:* Versions 1.1.2_beta Vulnerable ·Elefant
- cpe:2.3:a:elefantcms:elefantcms:1.1.3_beta:*:*:*:*:*:*:* Versions 1.1.3_beta Vulnerable ·Elefant
- cpe:2.3:a:elefantcms:elefantcms:*:*:*:*:*:*:*:* Versions up to 1.0.1 Vulnerable ·Elefant
Remediation
- Fix · GHSA-qjjq-rcq8-jw6j elefant/cms (Packagist) Fixed in 1.0.2-Beta Advisory →
- Fix · GHSA-qjjq-rcq8-jw6j elefant/cms (Packagist) Fixed in 1.1.5-Beta Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2012-1296
- 2026-10-03 Alias added: GHSA-qjjq-rcq8-jw6j
References
Advisory 2
Other 7
- https://www.htbridge.com/advisory/HTB23076
- http://www.elefantcms.com/wiki/Changelog
- https://github.com/jbroadway/elefant/commit/1e38b1d91d9f8bfb4a0cda8316fe763a6cdd31d0
- https://github.com/jbroadway/elefant/commit/4fc4e0a704f697e593be927a447ca12b2863ff85
- https://github.com/jbroadway/elefant
- https://web.archive.org/web/20120306001248/http://www.elefantcms.com/forum/discussion/39/elefant-1.0.2-and-1.1.5-security-updates-released
- https://web.archive.org/web/20200229030623/http://www.securityfocus.com/bid/52143
More Elefantcms vulnerabilities
- TI-2017-14124 Elefant CMS Version Comparison Persistent cross site scriting CVSS 3.1MEDIUM 6.1
- TI-2018-11128 apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step… CVSS 3.0CRITICAL 9.8
- TI-2018-11745 An issue was discovered in Elefant CMS before 2.0.5. CVSS 3.0HIGH 8.8
- TI-2012-05239 Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-1296 · CVE Program
- CVE-2012-1296 · NVD
- FIRST EPSS
- GHSA-qjjq-rcq8-jw6j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences