{"cve":"CVE-2012-1110","nvd":{"published":"2012-09-06T18:55:01.097","modified":"2026-06-16T23:39:02.627","status":"Modified","description":"Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9) f17_country, (10) f17_state, (11) f17_zip, (12) f19, (13) wphoto, (14) search, or (15) v parameter to search.php; (16) PATH_INFO or (17) st parameter to photo_search.php; or (18) return parameter to photo_view.php.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-79"],"references":["http://archives.neohapsis.com/archives/bugtraq/2012-03/0013.html","http://secunia.com/advisories/48165","http://www.openwall.com/lists/oss-security/2012/03/05/15","http://www.openwall.com/lists/oss-security/2012/03/05/21","http://www.osvdb.org/79827"],"products":["datemill:etano"],"source":"nvd","synced_at":"2026-10-19T20:25:53.526315492+00:00"},"epss":{"cve":"CVE-2012-1110","score":0.02715,"percentile":0.86013,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}