VIR Vulnerability Intelligence Relay

CVE-2012-4000

medium
Published 2012-07-12 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-37457 webapps php verified
Emilio Pinna · 2012-06-25

FCKEditor Core - 'Editor 'spellchecker.php' Cross-Site Scripting

Source code queued for fetch — refresh in a moment.

Application impact
VendorProductVersionsFixed
ckeditorfckeditor{"endIncluding":"2.6.7"}
ckeditorfckeditor0.8
ckeditorfckeditor0.8.5
ckeditorfckeditor0.9.0
ckeditorfckeditor0.9.1
ckeditorfckeditor0.9.2
ckeditorfckeditor0.9.3
ckeditorfckeditor0.9.4
ckeditorfckeditor0.9.5
ckeditorfckeditor1.0
ckeditorfckeditor1.1
ckeditorfckeditor1.2
ckeditorfckeditor1.2.2
ckeditorfckeditor1.2.4
ckeditorfckeditor1.3
ckeditorfckeditor1.3.1
ckeditorfckeditor1.4
ckeditorfckeditor1.5
ckeditorfckeditor1.6
ckeditorfckeditor2.0
ckeditorfckeditor2.1
ckeditorfckeditor2.1.1
ckeditorfckeditor2.2
ckeditorfckeditor2.3
ckeditorfckeditor2.3.1
ckeditorfckeditor2.3.2
ckeditorfckeditor2.3.3
ckeditorfckeditor2.4
ckeditorfckeditor2.4.1
ckeditorfckeditor2.4.2
ckeditorfckeditor2.4.3
ckeditorfckeditor2.5
ckeditorfckeditor2.5.1
ckeditorfckeditor2.6
ckeditorfckeditor2.6.1
ckeditorfckeditor2.6.2
ckeditorfckeditor2.6.3
ckeditorfckeditor2.6.4
ckeditorfckeditor2.6.4.1
ckeditorfckeditor2.6.5

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.