CVE-2012-0767

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before...

6.1 MediumIn KEV

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

6.19%Up 4.8 points since Feb 4, 2022

What each source reports

NVD Score used 6.1

Record: CVE-2012-0767
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 6.1

Record: CVE-2012-0767
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2012-0799 6.1

Record: EUVD-2012-0799
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gwxh-45g8-xg45 6.1

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before...

Record: GHSA-gwxh-45g8-xg45
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CISA KEV No score

Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

Record: CVE-2012-0767
Weakness: CWE-79
Updated: 2026-11-02

Affected products

adobe flash player

Affected packages

Affected packages
Package	Affected	Fixed
`flash-plugin` Red Hat:rhel_extras:5::client From an advisory covering 6 CVEs	before 0:10.3.183.15-1.el5	0:10.3.183.15-1.el5
`flash-plugin` Red Hat:rhel_extras:5::server From an advisory covering 6 CVEs	before 0:10.3.183.15-1.el5	0:10.3.183.15-1.el5
`flash-plugin` Red Hat:rhel_extras:6 From an advisory covering 6 CVEs	before 0:10.3.183.15-1.el6	0:10.3.183.15-1.el6

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0767 is a medium vulnerability (CVSS 6.1) in Adobe Flash Player, published February 16, 2012. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.19%, the 93rd percentile. No source names a fixed version.

References

Show 28 moreShow less