CVE-2012-1036
Status: ModifiedMedium (4.3)—
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.92%
- Percentile among all scored CVEs: 59
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-79
References
Raw JSON (NVD)
Show
{
"id": "CVE-2012-1036",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2012-04-11T10:39:26.387",
"references": [
{
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"source": "cve@mitre.org"
},
{
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el editor HTML telerik en DotNetNuke anteriores a v5.6.4 y v6.x anteriores a v6.1.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un mensaje."
}
],
"lastModified": "2026-06-16T23:38:52.840",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55C8F73C-26DC-4A1A-AAFB-64203E90CA94",
"versionEndIncluding": "5.6.3"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EB0D105-8943-4DC8-A513-064B1ABC4A9D"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39FED945-3341-4736-95C4-88CFE8B48E83"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B9C52F9-E7B7-4EA2-84FD-C78A3EF17893"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EFE03E3-0F41-4921-916F-56CDCCE77602"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7C8162B-2426-48F5-A143-FA7425F961B2"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40D39FE4-5D47-462B-B46E-19F6BE2F6197"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DD98E0F-ABC7-43CF-B2C2-D0027D3D27B0"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E96050B6-DE09-49DF-8D6D-1F110AC609EC"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E32FB03-B65E-4FD3-9595-ED8D19F2ABD8"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEF953F4-BCAB-4FBA-AEA1-3846E0C19BCD"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CD34D98-57B1-4567-B22A-69BCDA96367B"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E7DD606-ACEC-49F7-968B-93CE92DE0FAD"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3364254-4E9D-4218-BAA6-366A59B3D278"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC69C5AD-E642-4975-BF78-0A87A98C0033"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CF511FB-9BF5-4282-BD46-E7B173B4C554"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60DB93BB-9E8C-495C-B6F9-96DE89864A7D"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25638D29-3B1C-4093-B85F-622EC84168D2"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26FC5FB1-A6CA-4099-8068-6F01A3A15BB7"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1DE6781-FF23-41F3-AC24-4574DB091970"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E03F432-AAEC-49FC-97FE-C816FCC3D8E7"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "805FB485-A468-442F-94B0-FFC51FBB8891"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8FC888B-C2EE-459B-9E57-C11C79BDDDBF"
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D38E404-2A46-4014-ABEB-DFAD5AB2EA95"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC"
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}