CVE-2012-1262
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38,...
CVE-2012-1262 is a medium vulnerability (CVSS 4.3) in Movabletype Movable Type Advanced, published March 2, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 79th percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.83%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
movabletype-opensourceDebian:6.0 From an advisory covering 8 CVEs | before 4.3.8+dfsg-0+squeeze2, plus listed versions 4.3.5+dfsg-24.3.5+dfsg-2+squeeze14.3.5+dfsg-2+squeeze24.3.5+dfsg-34.3.6+dfsg-14.3.6.1+dfsg-14.3.7+dfsg-1 | 4.3.8+dfsg-0+squeeze2 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
- Record
CVE-2012-1262- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
- Record
CVE-2012-1262- Updated
- 2026-11-02
EUVDEUVD-2012-1288No score
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
- Record
EUVD-2012-1288- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3r2-wwq7-q6h3No score
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38,...
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
- Record
GHSA-v3r2-wwq7-q6h3- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2012/Feb/407
movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html
securityfocus.com/bid/52138
debian.org/security/2012/dsa-2423
securitytracker.com/id?1026738
Show 9 moreShow less
trustwave.com/spiderlabs/advisories/TWSL2012-003.txt
jvndb.jvn.jp/jvndb/JVNDB-2012-000016
exchange.xforce.ibmcloud.com/vulnerabilities/73480
jvn.jp/en/jp/JVN49836527/index.html
osvdb.org/79470
nvd.nist.gov/vuln/detail/CVE-2012-1262
github.com/advisories/GHSA-v3r2-wwq7-q6h3