CVE-2012-20xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

6 records · Page 1 of 1

• CVE-2012-20006: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Updated 2026-10-26 · Rejected record
• CVE-2012-20005: SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter 5.1 Medium

  SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observ

  Updated 2026-10-27
• CVE-2012-20004: K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter 5.1 Medium

  K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Ex

  Updated 2026-10-23
• CVE-2012-20003: Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php 5.1 Medium

  Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitatio

  Updated 2026-10-23
• CVE-2012-20002: TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php 8.7 High

  TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the

  Updated 2026-10-28
• CVE-2012-20001: PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field. Unscored

  PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.

  Updated 2024-08-06

Search a CVE ID or check dependency files →