Vulnerability record · CVE-2012-1001 · published 21 November 2019

CVE-2012-1001: Chyrp cross-site scripting vulnerability

Chyrp · Chyrp

Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.

6.1 CVSS 3.1 Medium EPSS 3.6% · top 11.1% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score, v2 4.3

3.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Chyrp Chyrp

References

Link	Tags
http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html	Broken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/	Broken Link
http://www.securityfocus.com/bid/52115	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/52117	Third Party AdvisoryVDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c	PatchThird Party Advisory
https://www.htbridge.ch/advisory/HTB23073	ExploitThird Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html	Broken Link
http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/	Broken Link
http://www.securityfocus.com/bid/52115	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/52117	Third Party AdvisoryVDB Entry
https://github.com/vito/chyrp/commit/f69bd791c37e0b154c0bda16f9759ba19cc77f6c	PatchThird Party Advisory
https://www.htbridge.ch/advisory/HTB23073	ExploitThird Party Advisory

Track CVE-2012-1001 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2025-69768Chyrp sql injection vulnerabilitySQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php componentEPSS 0.41%16 Mar 2026 6.8CVE-2011-2744Chyrp path traversal vulnerabilityDirectory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded …EPSS 9.0%19 Jul 2011 6.5CVE-2011-2745Chyrp permissions and access controls vulnerabilityupload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploa…EPSS 2.0%27 Jul 2011 5.3CVE-2024-58285Chyrp cross-site scripting vulnerabilityChyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attack…EPSS 0.26%10 Dec 2025 5.0CVE-2011-2780Chyrp path traversal vulnerabilityDirectory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) …EPSS 13%19 Jul 2011 4.3CVE-2011-2743Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the ac…EPSS 2.3%19 Jul 2011 3.5CVE-2014-7264Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin comp…EPSS 1.4%11 Dec 2014 6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed14 May 2026

Source: NIST National Vulnerability Database (record CVE-2012-1001), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.