Every CVE Search/ Get API key

CVE-2012-6112

PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

5.0 MediumFix available

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Exploit likelihood

2.29%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
CVE-2012-6112
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
CVE-2012-6112
Updated
2026-11-02
EUVDEUVD-2022-3849 No score

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
EUVD-2022-3849
Updated
2026-11-03
GitHub AdvisoriesGHSA-fx5h-3786-h2w6 No score

PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
GHSA-fx5h-3786-h2w6
Updated
2026-11-02
OSV No score

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
CVE-2012-6112
Updated
2026-11-02
OSVDEBIAN-CVE-2012-6112 No score

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
DEBIAN-CVE-2012-6112
Updated
2026-11-02
OSVGHSA-fx5h-3786-h2w6 No score

PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
GHSA-fx5h-3786-h2w6
Updated
2026-11-02
OSVUBUNTU-CVE-2012-6112 No score

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.

Record
UBUNTU-CVE-2012-6112
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle/moodle
Packagist
 2.1.0 up to 2.1.10
2.1.10
moodle/moodle
Packagist
 2.2.0 up to 2.2.7
2.2.7
moodle/moodle
Packagist
 2.3.0 up to 2.3.4
2.3.4
moodle/moodle
Packagist
 2.4.0 to 2.4.0
2.4.1
wordpress
Debian:12
 before 3.5.1+dfsg-2
3.5.1+dfsg-2
wordpress
Debian:13
 before 3.5.1+dfsg-2
3.5.1+dfsg-2
wordpress
Debian:14
 before 3.5.1+dfsg-2
3.5.1+dfsg-2
moodle/moodle
Packagist
 2.4.0 up to 2.4.1, plus listed versions
v2.4.0
2.4.1
tinymce
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.4.8+dfsg0-1
 None known
tinymce
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.4.8+dfsg0-2
 None known
tinymce
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.4.8+dfsg0-2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-6112 is a medium vulnerability (CVSS 5.0) in Moodle, published January 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in moodle/moodle 2.1.10.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open