{"id":"CVE-2012-1470","aliases":["EUVD-2012-1488","GHSA-4hrg-xfv8-3947"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6...","description":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01682,"percentile":0.77111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2012-10-01T23:00:00Z","modified":"2026-06-16T23:39:35Z","exploits":[{"source":"exploitdb","id":"EDB-37022","title":"ocPortal 7.1.5 - 'code_editor.php' Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2012-03-28","verified":true,"url":"https://www.exploit-db.com/exploits/37022"}],"products":[{"vendor":"ocportal","product":"ocportal"}],"references":[{"url":"http://ocportal.com/site/news/view/ocportal-security-update.htm","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.htbridge.com/advisory/HTB23078","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1470"},{"url":"https://github.com/advisories/GHSA-4hrg-xfv8-3947"}],"sources":{"cve":[{"id":"CVE-2012-1470","description":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.","status":"published","published":"2012-10-01T23:00:00Z","modified":"2024-09-17T01:21:49.834Z","updated_at":"2026-11-02T14:34:51.937988Z"}],"euvd":[{"id":"EUVD-2012-1488","description":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.","status":"published","published":"2012-10-01T23:00:00Z","modified":"2024-09-17T01:21:49Z","updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-4hrg-xfv8-3947","title":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6...","description":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.","status":"published","published":"2022-05-17T05:20:47Z","modified":"2023-01-28T05:03:34Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:44:00.261556Z"}],"nvd":[{"id":"CVE-2012-1470","description":"Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters.","status":"published","published":"2012-10-01T23:55:00.877Z","modified":"2026-06-16T23:39:35.817Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:16.115119Z"}]}}