CVE-2012-0914

Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title.

• CWE-79

• http://drupal.org/node/1409436Patch, Vendor Advisory
• http://drupal.org/node/1409446Patch
• http://drupal.org/node/1409448Patch
• http://drupalcode.org/project/panels.git/commit/2066d59
• http://drupalcode.org/project/panels.git/commit/d844942
• http://osvdb.org/78367
• http://secunia.com/advisories/47649Vendor Advisory
• http://www.madirish.net/content/drupal-panels-6x-39-xss-vulnerabilityPatch
• http://www.securityfocus.com/bid/51568
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72549
• http://drupal.org/node/1409436Patch, Vendor Advisory
• http://drupal.org/node/1409446Patch
• http://drupal.org/node/1409448Patch
• http://drupalcode.org/project/panels.git/commit/2066d59
• http://drupalcode.org/project/panels.git/commit/d844942
• http://osvdb.org/78367
• http://secunia.com/advisories/47649Vendor Advisory
• http://www.madirish.net/content/drupal-panels-6x-39-xss-vulnerabilityPatch
• http://www.securityfocus.com/bid/51568
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72549

Published

Jan 24, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0907Directory traversal vulnerability in the web player in NeoAx…
• CVE-2012-0908Cross-site scripting (XSS) vulnerability in logout.php in Si…
• CVE-2012-0909Cross-site scripting (XSS) vulnerability in Horde_Form in Ho…
• CVE-2012-0911TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows …9.8
• CVE-2012-0912SQL injection vulnerability in Stoneware webNetwork before 6…
• CVE-2012-0913SQL injection vulnerability in checklogin.aspx in ICloudCent…
• CVE-2012-0915Integer signedness error in RenRen Talk 2.9 allows remote at…
• CVE-2012-0916Heap-based buffer overflow in RenRen Talk 2.9 allows remote …
• CVE-2012-0917Cross-site scripting (XSS) vulnerability in Hitachi IT Opera…
• CVE-2012-0918Unspecified vulnerability in Hitachi COBOL2002 Net Developer…
• CVE-2012-0919Cross-site scripting (XSS) vulnerability in Hitachi IT Opera…
• CVE-2012-0920Use-after-free vulnerability in Dropbear SSH Server 0.52 thr…