Medium CVE-2012-3522 EUVD-2012-3477GHSA-f3f3-5q5j-6v47

GeSHi vulnerable to Cross-site Scripting

Published Jun 13, 2014 · Updated Aug 6, 2024 · Assigned by redhat

Package: geshi/geshi Ecosystem: Packagist

Description

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	geshi/geshi	< 1.0.8.11	1.0.8.11	GHSA-f3f3-5q5j-6v47

References

http://sourceforge.net/p/geshi/code/2508/
FEDORA-2013-5411 vendor-advisory
[oss-security] 20120821 Re: CVE Request -- php-geshi / GeSHi (1.0.8.11): Remote directory traversal and information disclosure in the cssgen contrib module (plus possibly XSS, but it needs upstream to confirm) mailing-list
FEDORA-2013-5472 vendor-advisory
FEDORA-2013-5440 vendor-advisory