CVE-2012-1660

Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.

• CWE-79

• http://drupal.org/node/1472178Patch
• http://drupal.org/node/1472180Patch
• http://drupal.org/node/1472214Patch, Vendor Advisory
• http://drupalcode.org/project/webform.git/commit/90af819
• http://drupalcode.org/project/webform.git/commit/917fa91
• http://secunia.com/advisories/48310Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/04/07/1
• http://www.osvdb.org/79852
• http://www.securityfocus.com/bid/52345Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73779
• http://drupal.org/node/1472178Patch
• http://drupal.org/node/1472180Patch
• http://drupal.org/node/1472214Patch, Vendor Advisory
• http://drupalcode.org/project/webform.git/commit/90af819
• http://drupalcode.org/project/webform.git/commit/917fa91
• http://secunia.com/advisories/48310Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/04/07/1
• http://www.osvdb.org/79852
• http://www.securityfocus.com/bid/52345Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73779

Published

Sep 18, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1654Multiple cross-site scripting (XSS) vulnerabilities in the D…
• CVE-2012-1655Unspecified vulnerability in the UC PayDutchGroup / WeDeal p…
• CVE-2012-1656SQL injection vulnerability in the Multisite Search module 6…
• CVE-2012-1657Cross-site scripting (XSS) vulnerability in block_class.modu…
• CVE-2012-1658Cross-site scripting (XSS) vulnerability in the Read More Li…
• CVE-2012-1659Cross-site scripting (XSS) vulnerability in the Node Recomme…
• CVE-2012-1661ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not pr…
• CVE-2012-1662CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 …
• CVE-2012-1663Double free vulnerability in libgnutls in GnuTLS before 3.0.…
• CVE-2012-1664Multiple cross-site scripting (XSS) vulnerabilities in the a…
• CVE-2012-1665Multiple SQL injection vulnerabilities in the admin panel in…
• CVE-2012-1666Untrusted search path vulnerability in VMware Tools in VMwar…