TI-2012-04169 Aliases CVE-2012-4932 GHSA-6jr2-rmv9-r5w7

Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before…

LOW 23CWE-79Published 2012-12-28 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via (1) the having parameter in a manage action to index.php; (2) the Email field in an Add User action; (3) the Customer Name field in an Add Customer action; the (4) Street address, (5) Street address 2, (6) City, (7) Zip code, (8) State, (9) Country, (10) Mobile Phone, (11) Phone, (12) Fax, (13) Email, (14) PayPal business name, (15) PayPal notify url, (16) PayPal return url, (17) Eway customer ID, (18) Custom field 1, (19) Custom field 2, (20) Custom field 3, or (21) Custom field 4 field in an Add Biller action; (22) the Customer field in an Add Invoice action; the (23) Invoice or (24) Notes field in a Process Payment action; (25) the Payment type description field in a Payment Types action; (26) the Description field in an Invoice Preferences action; (27) the Description field in a Manage Products action; or (28) the Description field in a Tax Rates action.

Why it matters now

EPSS 0.01319 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:simple_invoices:simple_invoices::::::::	up to 2011.1	Vulnerable	Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2006-12-11:::::::*	2006-12-11	Vulnerable	Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-01-25:::::::*	2007-01-25	Vulnerable	Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-02-02:::::::*	2007-02-02	Vulnerable	Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-05-25:::::::*	2007-05-25	Vulnerable	Simple Invoices

cpe:2.3:a:simple_invoices:simple_invoices:*:*:*:*:*:*:*:* Versions up to 2011.1 Vulnerable ·Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2006-12-11:*:*:*:*:*:*:* Versions 2006-12-11 Vulnerable ·Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-01-25:*:*:*:*:*:*:* Versions 2007-01-25 Vulnerable ·Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-02-02:*:*:*:*:*:*:* Versions 2007-02-02 Vulnerable ·Simple Invoices
cpe:2.3:a:simple_invoices:simple_invoices:2007-05-25:*:*:*:*:*:*:* Versions 2007-05-25 Vulnerable ·Simple Invoices

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2012-4932
2026-10-03 Alias added: GHSA-6jr2-rmv9-r5w7

References

Exploit 1

20121209 SimpleInvoices 2011.1 Cross-Site-Scripting (XSS) Vulnerabilities CVE-2012-4932

TI-2007-03324 SQL injection vulnerability in index.php in Simple Invoices 2007 05 25 allows remote… CVSS 2.0HIGH 7.5
TI-2007-00765 PHP remote file inclusion vulnerability in controller.php in Simple Invoices before… CVSS 2.0MEDIUM 6.8
TI-2007-01286 include/auth/auth.php in Simple Invoices before 2007 03 05 does not use the login system… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences