CVE-2012-4989: openx Cross-site Scripting

EPSS trend

Probability

4.39%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.39% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found

referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
referenceUnverified
Exploit Reference (htbridge.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Show all 4 exploits

exploit-databasephpVerified
OpenX 2.8.10 - 'plugin-index.php' Cross-Site Scripting
Maturity: poc

References

7 links

svn.openx.org/openx/trunk/lib/templates/admin/plugin-group-view.htmlX Refsource MISC
archives.neohapsis.com/archives/bugtraq/2012-10/0065.htmlMailing ListX Refsource BUGTRAQExploit
secunia.com/advisories/50877Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/79196VDB EntryX Refsource XF
www.htbridge.com/advisory/HTB23116X Refsource MISCExploit
osvdb.org/86092VDB EntryX Refsource OSVDB
www.securityfocus.com/bid/55860VDB EntryX Refsource BIDExploit

Related vulnerabilities

CriticalCVE-2013-4211openx · ad server +1 more6y agoopenx ad serverA Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP codeEPSS70.65%MediumCVE-2013-7376openx12y agoopenx openxMultiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-3514.EPSS1.25%HighCVE-2013-7149openx +1 more12y agoopenx openxSQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.EPSS2.01%MediumCVE-2013-5954openx +1 more12y agoopenx openxMultiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.EPSS3.09%MediumCVE-2013-3514openx12y agoopenx openxMultiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.EPSS3.33%MediumCVE-2013-3515openx13y agoopenx openxMultiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php.EPSS4.23%

All vulnerabilities inopenx

CVE-2012-4989: openx Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References