{"id":"CVE-2012-2575","aliases":["EUVD-2012-2561","GHSA-g442-gf3f-2wq6"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01319,"percentile":0.71001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2012-09-17T14:00:00Z","modified":"2026-06-16T23:41:42Z","exploits":[{"source":"exploitdb","id":"EDB-20363","title":"Surgemail 6.0a4 - Persistent Cross-Site Scripting","type":"webapps","platform":"windows","date":"2012-08-08","verified":true,"url":"https://www.exploit-db.com/exploits/20363"}],"products":[{"vendor":"netwin","product":"surgemail"}],"references":[{"url":"http://www.exploit-db.com/exploits/20363/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2575"},{"url":"http://www.exploit-db.com/exploits/20363"},{"url":"https://github.com/advisories/GHSA-g442-gf3f-2wq6"}],"sources":{"cve":[{"id":"CVE-2012-2575","description":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.","status":"published","published":"2012-09-17T14:00:00Z","modified":"2024-09-16T20:37:44.287Z","updated_at":"2026-11-02T14:34:49.937255Z"}],"euvd":[{"id":"EUVD-2012-2561","description":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.","status":"published","published":"2012-09-17T14:00:00Z","modified":"2024-09-16T20:37:44Z","updated_at":"2026-11-03T00:55:12.113193Z"}],"ghsa":[{"id":"GHSA-g442-gf3f-2wq6","title":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to...","description":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.","status":"published","published":"2022-05-17T05:22:06Z","modified":"2025-04-11T04:03:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:12.54248Z"}],"nvd":[{"id":"CVE-2012-2575","description":"Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.","status":"published","published":"2012-09-17T14:55:00.813Z","modified":"2026-06-16T23:41:42.52Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:15.643902Z"}]}}