CVE-2011-4709

CVE-2011-4709 describes multiple Cross-Site Scripting (XSS) vulnerabilities in the Hotaru.php file of the Search plugin 1.3 for Hotaru CMS, specifically affecting versions of Hotaru CMS and its Search plugin. Attackers can inject arbitrary web script or HTML via the SITE_NAME parameter in admin_index.php, or the return and search parameters in index.php. With a CVSS score of 4.3 (Medium), this vulnerability has a network-based attack vector and medium attack complexity, requiring no authentication. The potential impact is limited to partial integrity compromise (I:P), meaning data could be altered or defaced, but not necessarily disclosed or made unavailable. While not listed on the CISA KEV catalog or Hot List, exploit code is publicly available via ExploitDB (EDB-36307). There is no evidence of active exploitation, and community discussion and media coverage are minimal, indicating low public awareness.