CVE-2012-0873

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

• CWE-79

• http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.htmlExploit
• http://www.boonex.com/n/dolphin-7-0-8-released
• http://www.boonex.com/trac/dolphin/changeset/15282Patch
• http://www.boonex.com/trac/dolphin/changeset/15283Exploit, Patch
• http://www.boonex.com/trac/dolphin/ticket/2530Patch
• http://www.openwall.com/lists/oss-security/2012/02/20/11Exploit
• http://www.openwall.com/lists/oss-security/2012/02/20/6Exploit
• http://www.securityfocus.com/bid/52088Exploit
• http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xssExploit
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.htmlExploit
• http://www.boonex.com/n/dolphin-7-0-8-released
• http://www.boonex.com/trac/dolphin/changeset/15282Patch
• http://www.boonex.com/trac/dolphin/changeset/15283Exploit, Patch
• http://www.boonex.com/trac/dolphin/ticket/2530Patch
• http://www.openwall.com/lists/oss-security/2012/02/20/11Exploit
• http://www.openwall.com/lists/oss-security/2012/02/20/6Exploit
• http://www.securityfocus.com/bid/52088Exploit
• http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xssExploit

Published

Feb 23, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0867PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.…
• CVE-2012-0868CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x …
• CVE-2012-0869Cross-site scripting (XSS) vulnerability in fup in Frams' Fa…
• CVE-2012-0870Heap-based buffer overflow in process.c in smbd in Samba 3.0…
• CVE-2012-0871The session_link_x11_socket function in login/logind-session…
• CVE-2012-0872Multiple cross-site scripting (XSS) vulnerabilities in OxWal…
• CVE-2012-0874The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invo…
• CVE-2012-0875SystemTap 1.7, 1.6.7, and probably other versions, when unpr…
• CVE-2012-0876The XML parser (xmlparse.c) in expat before 2.1.0 computes h…
• CVE-2012-0877PyXML: Hash table collisions CPU usage Denial of Service7.5
• CVE-2012-0878Paste Script 1.7.5 and earlier does not properly set group m…
• CVE-2012-0879The I/O implementation for block devices in the Linux kernel…5.5