CVE-2012-5357

Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

• CWE-19

• http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htmIssue Tracking, Vendor Advisory
• https://technet.microsoft.com/library/security/msvr12-016Issue Tracking, Release Notes, Third Party Advisory
• https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/Exploit, Issue Tracking, Third Party Advisory
• https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_execExploit, Issue Tracking, Third Party Advisory
• http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htmIssue Tracking, Vendor Advisory
• https://technet.microsoft.com/library/security/msvr12-016Issue Tracking, Release Notes, Third Party Advisory
• https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/Exploit, Issue Tracking, Third Party Advisory
• https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_execExploit, Issue Tracking, Third Party Advisory

Published

Oct 30, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-5351Apache Axis2 allows remote attackers to forge messages and b…
• CVE-2012-5352Java Open Single Sign-On Project Home (JOSSO) allows remote …
• CVE-2012-5353Eduserv OpenAthens SP 2.0 for Java allows remote attackers t…
• CVE-2012-5354Mozilla Firefox before 16.0, Thunderbird before 16.0, and Se…
• CVE-2012-5355welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local u…
• CVE-2012-5356The apt-add-repository tool in Ubuntu Software Properties 0.…
• CVE-2012-5358The XSLTCompiledTransform function in Ektron Content Managem…
• CVE-2012-5359Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5360Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5361Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5362The IPv6 implementation in Microsoft Windows 7 and earlier a…7.5
• CVE-2012-5363The IPv6 implementation in FreeBSD and NetBSD (unknown versi…7.5