Skip to content

CVE-2012-2275

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow...

6.8 MediumPublic exploit

CVE-2012-2275 is a medium vulnerability (CVSS 6.8) in Teamst Testlink, published September 15, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. No source names a fixed version.

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Exploit likelihood

2.73%Down 6.4 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Record: CVE-2012-2275
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Record: CVE-2012-2275
Updated: 2026-11-02

EUVDEUVD-2012-2268 No score

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Record: EUVD-2012-2268
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m26p-926q-cmv4 No score

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow...

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Record: GHSA-m26p-926q-cmv4
Weakness: CWE-352
Updated: 2026-11-02

Affected products

teamst testlink

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	TestLink 1.9.3 - Cross-Site Request Forgery	2012-09-07

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

References

Show 4 moreShow less