CVE-2012-1660 json
Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x befo…
published 2012-09-18 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-1670
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.
Patch / fix
- drupalcode.org/project/webform.git@917fa91 commit
- drupalcode.org/project/webform.git@90af819 commit
- drupal.org/node/1472180 patch
- drupal.org/node/1472178 patch
- securityfocus.com/bid/52345 patch
- drupal.org/node/1472214 advisory
Exploit prediction
1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- drupalcode.org /project/webform.git/commit/917fa91
- drupalcode.org /project/webform.git/commit/90af819
-
drupal.org
/node/1472180
patch
-
drupal.org
/node/1472178
patch
-
securityfocus.com
/bid/52345
vdb-entry, patch
-
drupal.org
/node/1472214
patch, vendor-advisory
-
secunia.com
/advisories/48310
third-party-advisory, vendor-advisory
-
openwall.com
/lists/oss-security/2012/04/07/1
mailing-list
-
osvdb.org
/79852
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/73779
vdb-entry
Sources
- CVE List CVE-2012-1660
- NVD CVE-2012-1660
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.