CVE-2012-4870

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to panel/flash/mypage.php; (5) PATH_INFO to admin/views/freepbx_reload.php; or (6) login parameter to recordings/index.php.

• CWE-79

• http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.htmlExploit
• http://seclists.org/fulldisclosure/2012/Mar/234Exploit
• http://secunia.com/advisories/48463Vendor Advisory
• http://secunia.com/advisories/48475Vendor Advisory
• http://www.exploit-db.com/exploits/18649Exploit
• http://www.freepbx.org/trac/ticket/5711
• http://www.securityfocus.com/bid/52630Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74173
• http://packetstormsecurity.org/files/111028/FreePBX-2.10.0-Remote-Command-Execution-XSS.htmlExploit
• http://seclists.org/fulldisclosure/2012/Mar/234Exploit
• http://secunia.com/advisories/48463Vendor Advisory
• http://secunia.com/advisories/48475Vendor Advisory
• http://www.exploit-db.com/exploits/18649Exploit
• http://www.freepbx.org/trac/ticket/5711
• http://www.securityfocus.com/bid/52630Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74173

Published

Sep 6, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4864Oreans WinLicense 2.1.8.0 allows remote attackers to cause a…
• CVE-2012-4865Buffer overflow in Oreans Themida 2.1.8.0 allows remote atta…
• CVE-2012-4866Untrusted search path vulnerability in Xtreme RAT 3.5 allows…
• CVE-2012-4867Directory traversal vulnerability in modules/com_vtiger_work…
• CVE-2012-4868SQL injection vulnerability in news.php in the Kunena compon…
• CVE-2012-4869The callme_startcall function in recordings/misc/callme_page…
• CVE-2012-4871Cross-site scripting (XSS) vulnerability in service/graph_ht…
• CVE-2012-4872Cross-site scripting (XSS) vulnerability in Tickets/Submit i…
• CVE-2012-4873Cross-site scripting (XSS) vulnerability in the file_downloa…
• CVE-2012-4874Unspecified vulnerability in the Another WordPress Classifie…
• CVE-2012-4875Heap-based buffer overflow in gdevwpr2.c in Ghostscript 9.04…
• CVE-2012-4876Stack-based buffer overflow in the UltraMJCam ActiveX Contro…