Cross-site scripting (XSS) vulnerability in pivotx/modules/module_image.php in PivotX before 2.2.3 allows remote attackers to inject arbitr…

1. 2011-01-25 First public exploit (EDB-35254)
2. 2011-02-04 Published

2.36% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

• EDB-35254 PivotX 2.2.2 - 'module_image.php' Cross-Site Scripting webapps, 2011-01-25
• osvdb.org http://osvdb.org/70672 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/45983 referenced PoC, tagged "exploit" by a source, unverified
• packetstormsecurity.org http://packetstormsecurity.org/files/view/97831/Pivotx222-xss.txt referenced PoC, tagged "exploit" by a source, unverified
• autosectools.com http://www.autosectools.com/Advisories/PivotX.2.2.2_Reflected.Cross-site.Scripting_76.html referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation

• blog.pivotx.net /2011-01-31/pivotx-223-released

  patch, vendor-advisory

• osvdb.org /70672

  vdb-entry, exploit

• securityfocus.com /bid/45983

  vdb-entry, exploit

• packetstormsecurity.org /files/view/97831/Pivotx222-xss.txt

  exploit

• autosectools.com /Advisories/PivotX.2.2.2_Reflected.Cross-site.Scripting_76.html

  exploit

• secunia.com /advisories/43045

  third-party-advisory, vendor-advisory

• pivot-weblog.svn.sf.net /viewvc/pivot-weblog?view=revision&revision=3459
• exchange.xforce.ibmcloud.com /vulnerabilities/64976

  vdb-entry

• twitter.com /pivotx/statuses/29889056263376898
• securityreason.com /securityalert/8063

  third-party-advisory

• CVE List CVE-2011-0773
• NVD CVE-2011-0773

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.