CVE-2012-1990

CVE-2012-1990 describes multiple cross-site scripting (XSS) vulnerabilities affecting Schneider Electric Kerweb before version 3.0.1 and Kerwin before 6.0.1. These flaws allow remote attackers to inject arbitrary web script or HTML through specific parameters and fields, potentially leading to client-side attacks. With a CVSS score of 4.3 (medium severity), successful exploitation requires medium attack complexity and could result in information disclosure or defacement, though it does not impact confidentiality or availability. While not listed on the CISA KEV catalog, an exploit for kw.dll has been publicly disclosed on ExploitDB, yet there is no evidence of active exploitation or significant community discussion.