CVE-2012-6667 describes a Cross-site Scripting (XSS) vulnerability in the DragonByte Technologies vBShout module for vBulletin, specifically within the vbshout.php script. This flaw allows remote attackers to inject arbitrary web script or HTML through the 'shout' parameter during a 'shout' action. With a CVSS score of 6.1 (Medium), this vulnerability has a low attack complexity and requires user interaction, but can lead to limited confidentiality and integrity impacts. The attack vector is network-based, indicating it can be exploited remotely. While there is no evidence of active exploitation (KEV: No) and no Metasploit or Nuclei modules exist, an exploit (EDB-18644) is publicly available on ExploitDB. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.2.18CPE matchmatch criteria | cpe:2.3:a:dragonbyte-tech:vbshout:*:*:*:*:*:vbulletin:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.