CVE-2012-2629

Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator account via an addnew action to admin/administrators_add.php; or (2) conduct cross-site scripting (XSS) attacks via the page_title parameter to admin/content_pages_edit.php; the (3) category_name[] parameter to admin/products_category.php; the (4) site_name, (5) seo_title, or (6) meta_keywords parameter to admin/settings_siteinfo.php; the (7) company_name, (8) address1, (9) address2, (10) city, (11) state, (12) country, (13) author_first_name, (14) author_last_name, (15) author_email, (16) contact_first_name, (17) contact_last_name, (18) contact_email, (19) general_email, (20) general_phone, (21) general_fax, (22) sales_email, (23) sales_phone, (24) support_email, or (25) support_phone parameter to admin/settings_company.php; or the (26) system_email, (27) sender_name, (28) smtp_server, (29) smtp_username, (30) smtp_password, or (31) order_notice_email parameter to admin/settings_email.php.

• CWE-352

• http://packetstormsecurity.com/files/112748/Axous-1.1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/18886Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/112748/Axous-1.1.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/18886Exploit, Third Party Advisory, VDB Entry

Published

Feb 20, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-2615Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2012-2619The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in cer…
• CVE-2012-2624Stack-based buffer overflow in Logica HotScan allows remote …
• CVE-2012-2625The PyGrub boot loader in Xen unstable before changeset 2558…
• CVE-2012-2626cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (…
• CVE-2012-2627d4d/uploader.php in the web console in Plixer Scrutinizer (a…
• CVE-2012-2630The Puella Magi Madoka Magica iP application 1.05 and earlie…
• CVE-2012-2631Cross-site scripting (XSS) vulnerability in WEBLOGIC @WEB Sh…
• CVE-2012-2632SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/…
• CVE-2012-2633Cross-site scripting (XSS) vulnerability in wassup.php in th…
• CVE-2012-2634Cross-site scripting (XSS) vulnerability in FeedDemon before…
• CVE-2012-2635The Dolphin Browser HD application before 7.6 and Dolphin fo…