TI-2012-04580 Aliases CVE-2012-5452 GHSA-3r5w-8fgx-8jrh

Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote…

LOW 28CWE-79Published 2012-10-22 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en] parameter to fields/group/add/ in admin/manage/; or (7) f[accounts][fullname] or (8) f[accounts][username] parameter to advsearch/. NOTE: This might overlap CVE-2011-5211. NOTE: it was later reported that the f[accounts][fullname] and f[accounts][username] vectors might also affect 2.2.2.

Why it matters now

EPSS 0.05077 92nd percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:intelliants:subrion_cms:2.2.1:::::::*	2.2.1	Vulnerable	Intelliants

cpe:2.3:a:intelliants:subrion_cms:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Intelliants

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2012-5452
2026-10-03 Alias added: GHSA-3r5w-8fgx-8jrh

References

Exploit 3

Advisory 1

http://www.subrion.com/forums/announcements/893-subrion-open-source-cms-2-2-2-has-been-released.html

Other 1

http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html

TI-2018-13753 /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code… CVSS 3.1HIGH 7.2
TI-2025-43172 Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module… CVSS 3.1MEDIUM 6.1
TI-2023-23544 Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS… CVSS 3.1MEDIUM 6.1
TI-2022-21043 A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants… CVSS 3.1MEDIUM 6.1
TI-2017-08464 Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. CVSS 3.0CRITICAL 9.8
TI-2025-35369 An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or… CVSS 3.1LOW 3.8

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences