CVE-2012-1110

medium

Published 2012-09-06 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9) f17_country, (10) f17_state, (11) f17_zip, (12) f19, (13) wphoto, (14) search, or (15) v parameter to search.php; (16) PATH_INFO or (17) st parameter to photo_search.php; or (18) return parameter to photo_view.php.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-36899 webapps php verified

Aung Khant · 2012-03-05

Etano 1.20/1.22 - 'photo_search.php' Multiple Cross-Site Scripting Vulnerabilities

Source code queued for fetch — refresh in a moment.

EDB-36900 webapps php verified

Aung Khant · 2012-03-05

Etano 1.20/1.22 - 'photo_view.php?return' Cross-Site Scripting

Source code queued for fetch — refresh in a moment.

EDB-36898 webapps php verified

Aung Khant · 2012-03-05

Etano 1.20/1.22 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities

Source code queued for fetch — refresh in a moment.

Application impact

Vendor	Product	Versions	Fixed
datemill	etano	`{"endIncluding":"1.22"}`

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.