Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2012-3414

CVSSv4: NA | CVSSv3: NA | CVSSv2: 4.3 | VMScore: 530 | EPSS: 0.00897 | KEV: Not Included
Published: 19/07/2013 Updated: 21/11/2024

Vulnerability Summary

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and previous versions, as used in WordPress prior to 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote malicious users to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

Vulnerable Product Search on Vulmon Subscribe to Product

swfupload project swfupload

swfupload project swfupload 1.0.2

swfupload project swfupload 2.0.2

swfupload project swfupload 2.1.0

swfupload project swfupload 2.2.0

tinymce image manager 1.1

wordpress wordpress

wordpress wordpress -

wordpress wordpress 3.0

wordpress wordpress 3.0.1

wordpress wordpress 3.0.2

wordpress wordpress 3.0.3

wordpress wordpress 3.0.4

wordpress wordpress 3.0.5

wordpress wordpress 3.0.6

wordpress wordpress 3.1

wordpress wordpress 3.1.1

wordpress wordpress 3.1.2

wordpress wordpress 3.1.3

wordpress wordpress 3.1.4

wordpress wordpress 3.2

wordpress wordpress 3.2.1

wordpress wordpress 3.3

Exploits

Exploit DB: SWFupload - 'movieName' Cross-Site Scripting
source: wwwsecurityfocuscom/bid/54245/info SWFUpload is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the attacker to steal cooki ...
Exploit DB: WordPress E-Commerce 3.8.9.5 File Upload / XSS / CSRF / Code Execution
WordPress WP-E-Commerce plugin version 3895 suffers from local file inclusion, cross site scripting, cross site request forgery, file upload, and code execution vulnerabilities ...
Exploit DB: Dotclear 2.4.4 Cross Site Scripting / Content Spoofing
CMS Dotclear version 244 suffers from cross site scripting and content spoofing vulnerabilities ...
Exploit DB: SWF Upload Cross Site Scripting
Dotclear, InstantCMS, AionWeb, and Dolphin all include a version of swfuploadswf that suffers from a cross site scripting vulnerability ...
Exploit DB: WordPress 3.3.1 swfupload.swf Cross Site Scripting
WordPress versions 25 through 331 suffer from a cross site scripting vulnerability in swfuploadswf ...

Github Repositories

https://github.com/danifbento/SWFUpload

SWFUpload - Fork from SWFUpload Build 2.2.1

SWFUpload SWFUpload - Fork from SWFUpload Build 221 Original Project at: codegooglecom/p/swfupload/ LICENCE Copyright (C) 2006-2007 Lars Huring, Olov Nilzén and Mammon Media Copyright (C) 2007-2008 Jake Roberts Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software&qu

https://github.com/WordPress/secure-swfupload

A fork of the long-abandoned SWFUpload project, maintained by WordPress and others to ensure that a secure version of SWFUpload exists. Report security vulnerabilities to swfupload-security@wordpress.org.

SWFUpload (Maintained for Security Fixes) This is a fork of the long-abandoned SWFUpload project, maintained by WordPress and others to ensure that a secure version of SWFUpload exists We strongly suggest you do not use SWFUpload But if you must, use this fork WordPress is maintaining a secure version of SWFUpload for use by WordPress plugins that have yet to be updated to u

Recent Articles

Filthy! old! blog! bug! blamed! for! Yahoo! webmail! hijacks!
The Register • John Leyden • 01 Feb 2013

Unpatched WordPress flaw clears way for inbox takeovers

Yahoo! webmail accounts are being hijacked by hackers exploiting an eight-month-old bug in the web giant's blog, security biz Bitdefender warns. Messages with a short link to an apparently harmless MSNBC web-page are being spread to compromise mailboxes: the link actually points to a completely different website hosting malicious JavaScript code that swipes the victim's browser cookie used to log into Yahoo! mail. Once this cookie is in the hands of miscreants, they can use it to access the vici...

Read more...

References

CWE-79https://nvd.nist.govhttps://github.com/danifbento/SWFUploadhttps://www.exploit-db.com/exploits/37470/https://www.first.org/epsshttp://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.htmlhttp://code.google.com/p/swfupload/issues/detail?id=376http://make.wordpress.org/core/2013/06/21/secure-swfupload/http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.htmlhttp://www.openwall.com/lists/oss-security/2012/07/16/4http://www.openwall.com/lists/oss-security/2012/07/17/12http://www.securityfocus.com/bid/54245https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.htmlhttp://code.google.com/p/swfupload/issues/detail?id=376http://make.wordpress.org/core/2013/06/21/secure-swfupload/http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.htmlhttp://www.openwall.com/lists/oss-security/2012/07/16/4http://www.openwall.com/lists/oss-security/2012/07/17/12http://www.securityfocus.com/bid/54245https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
Preferred Score:
CVSSv2
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2025-21317CVE-2025-23940buffer overflowCVE-2025-21335CVE-2025-23860CVE-2024-57704SSTIwirelessCVE-2019-3309
Home
/
Search Results
/
CVE-2012-3414
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook