{"id":"CVE-2012-1259","aliases":["EUVD-2012-1285","GHSA-pvc9-w2p3-hggj"],"status":"published","title":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow...","description":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04247,"percentile":0.91101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2020-01-09T19:47:46Z","modified":"2026-06-16T23:39:20Z","exploits":[{"source":"exploitdb","id":"EDB-18750","title":"Scrutinizer NetFlow \u0026 sFlow Analyzer - Multiple Vulnerabilities","type":"webapps","platform":"multiple","date":"2012-04-19","verified":true,"url":"https://www.exploit-db.com/exploits/18750"}],"products":[{"vendor":"plixer","product":"scrutinizer_netflow_\\\u0026_sflow_analyzer"}],"references":[{"url":"http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://www.exploit-db.com/exploits/18750","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/52989","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/74826","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1259"},{"url":"https://github.com/advisories/GHSA-pvc9-w2p3-hggj"}],"sources":{"cve":[{"id":"CVE-2012-1259","description":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.","status":"published","published":"2020-01-09T19:47:46Z","modified":"2024-08-06T18:53:36.405Z","updated_at":"2026-11-02T14:34:52.27879Z"}],"euvd":[{"id":"EUVD-2012-1285","description":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.","status":"published","published":"2020-01-09T19:47:46Z","modified":"2024-08-06T18:53:36Z","updated_at":"2026-11-03T01:56:18.356301Z"}],"ghsa":[{"id":"GHSA-pvc9-w2p3-hggj","title":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow...","description":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.","status":"published","published":"2022-04-23T00:40:28Z","modified":"2023-01-27T05:02:01Z","updated_at":"2026-11-02T14:42:00.381555Z"}],"nvd":[{"id":"CVE-2012-1259","description":"Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow \u0026 sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.","status":"published","published":"2020-01-09T20:15:09.927Z","modified":"2026-06-16T23:39:20.233Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:18.043773Z"}]}}