CVE-2012-3522

GeSHi vulnerable to Cross-site Scripting

4.3 MediumFix available

CVE-2012-3522 is a medium vulnerability (CVSS 4.3) in Qbnz Geshi, published June 6, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in geshi/geshi 1.0.8.11.

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

1.24%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2012-3522
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2012-3522
Updated: 2026-11-02

EUVDEUVD-2012-3477 No score

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: EUVD-2012-3477
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f3f3-5q5j-6v47 5.3

GeSHi vulnerable to Cross-site Scripting

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-f3f3-5q5j-6v47
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-f3f3-5q5j-6v47 5.3

GeSHi vulnerable to Cross-site Scripting

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-f3f3-5q5j-6v47
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVMGASA-2013-0163 No score

Updated php-geshi package fix security vulnerabilities

A directory traversal and information disclosure (local file inclusion) flaws were found in the cssgen contrib module (application to generate custom CSS files) of GeSHi, a generic syntax highlighter, performed sanitization of 'geshi-path' and 'geshi-lang-path' HTTP GET / POST variables. A remote attacker could provide a specially-crafted URL that, when visited could lead to local file system traversal or, potentially, ability to read content of any local file, accessible with the privileges of the user running the webserver (CVE-2012-3251).

A cross-site scripting (XSS) flaw was found in the way 'langwiz' example script of GeSHi, a generic syntax highlighter, performed sanitization of certain HTTP GET / POST request variables (prior dumping their content). A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or web script execution (CVE-2012-3522).

Record: MGASA-2013-0163
Updated: 2026-11-02

OSVUBUNTU-CVE-2012-3522 No score

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: UBUNTU-CVE-2012-3522
Updated: 2026-11-02

Affected products

qbnz geshi

Affected packages

Affected packages
Package	Affected	Fixed
`geshi/geshi` Packagist	before 1.0.8.11	1.0.8.11
`php-geshi` Mageia:2	before 1.0.8.11-1.mga2	1.0.8.11-1.mga2

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less